[UPDATED] Multiple NETGEAR devices affected by password recovery exploit

If you have a NETGEAR router or cable modem, you’re going to want to check the model number and update the firmware if you haven’t recently done so. First discovered by Trustwave and verified by NETGEAR, certain models of NETGEAR routers are at risk of having web login passwords exposed using a password recovery exploit via the remote management feature.

UPDATE (02/01/2017): NETGEAR has provided us with this official statement, which reaffirms the need for those affected to update their routers with the fixed firmware.

NETGEAR is aware of the vulnerability (CVE-2017-5521), that has been recently publicized by TrustWave. This is not a new or recent development. We have been working with the security analysts to evaluate the vulnerability. NETGEAR has published a knowledge base article from our support page, which lists the affected routers and the available firmware fix.

Firmware fixes are currently available for the majority of the affected devices. To download the firmware release that fixes the password recovery vulnerability, click the link for the model and visit the firmware release page for further instructions. For devices that are still pending final firmware updates, please follow the advised work around.

Please note that this vulnerability occurs when an attacker can gain access to the internal network or when remote management is enabled on the router. Remote management is turned off by default; although remote management can turned on through the advanced settings.

NETGEAR does appreciate and value having security concerns brought to our attention. We constantly monitors for both known and unknown threats. Being pro-active rather than re-active to emerging security issues is fundamental for product support at NETGEAR.

It is NETGEAR’s mission to be the innovative leader in connecting the world to the internet. To achieve this mission, we strive to earn and maintain the trust of those that use NETGEAR products for their connectivity.

ORIGINAL STORY:

The security issue in question allows an attacker to access an affected NETGEAR router by bypassing authentication which gives them full access to the device, and thus your network. The exploit can be initialized when the attacker has access to the internal network or when the router has remote management enabled. According to Trustwave, their research found more than ten thousand devices that had remote management enabled and hypothesized that the number of affected devices is in the hundreds of thousands, if not more than a million.

NETGEAR has released a firmware update for many device models. If your router is one of the following models, NETGEAR urges you to update your firmware immediately:

A fix has also been released for the NETGEAR C6300 cable modem router. There are a number of other devices that are affected but don’t have a firmware fix. For these models (listed below), NETGEAR recommends that you manually enable the password recovery feature and ensure that remote management is disabled (which it is by default) on your device. Affected devices without a fix include:

Router Model and Firmware Version:

R6200 v1.0.1.56_1.0.43
R6300 v1.0.2.78_1.0.58
VEGN2610 v1.0.0.14_1.0.12
AC1450 v1.0.0.34_10.0.16
WNR1000v3 v1.0.2.68_60.0.93
WNDR3700v3 v1.0.0.38_1.0.31
WNDR4000 v1.0.2.4_9.1.86
WNDR4500 v1.0.1.40_1.0.68

DSL Gateway Model and Firmware Version:

D6300 v1.0.0.96
D6300B v1.0.0.40
DGN2200Bv4 v1.0.0.68
DGN2200v4 v1.0.0.76

NETGEAR also noted that their V6510 device is unaffected by this exploit.

Do you have a NETGEAR router? Are you affected by this password recovery exploit? Let us know in the comments below or on Google+, Twitter, or Facebook.

[button link=”https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2017-5521–Bypassing-Authentication-on-NETGEAR-Routers/” icon=”fa-external-link” side=”left” target=”blank” color=”285b5e” textcolor=”ffffff”]Source: Trustwave[/button][button link=”http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability” icon=”fa-external-link” side=”left” target=”blank” color=”285b5e” textcolor=”ffffff”]Source: Netgear[/button]