Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2021.0243
NETGEAR routers - Post-Authentication Command Injection &
Sensitive Information Disclosure
6 December 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: NETGEAR routers
Operating System: Network Appliance
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
OVERVIEW
NETGEAR have released an advisory stating that multiple routers are
vulnerable to post-authentication command injection and sensitive
information disclosure vulnerabilities. [1]
This is making the rounds across various media outlets. [2][3][4]
IMPACT
NETGEAR advise that the following products as vulnerable and
have listed fixed firmware versions.
"DSL Modem Routers
D7800 fixed in firmware version 1.0.1.66
Extenders
EX2700 fixed in firmware version 1.0.1.68
WN3000RPv2 fixed in firmware version 1.0.0.90
WN3000RPv3 fixed in firmware version 1.0.2.100
LTE Modems
LBR1020 fixed in firmware version 2.6.5.20
Orbi WiFi Systems
LBR20 fixed in firmware version 2.6.5.32
Routers
R6700AX fixed in firmware version 1.0.10.110
R7800 fixed in firmware version 1.0.2.86
R8900 fixed in firmware version 1.0.5.38
R9000 fixed in firmware version 1.0.5.38
RAX10 fixed in firmware version 1.0.10.110
RAX120v1 fixed in firmware version 1.2.3.28
RAX120v2 fixed in firmware version 1.2.3.28
RAX70 fixed in firmware version 1.0.10.110
RAX78 fixed in firmware version 1.0.10.110
XR450 fixed in firmware version 2.3.2.130
XR500 fixed in firmware version 2.3.2.130
XR700 fixed in firmware version 1.0.1.46" [1]
MITIGATION
NETGEAR have recommended that all affected devices be updated to the latest available firmware as soon as possible. [1]
Other sources have advised to update the login details for these routers, especially if they have been left at defaults. [2]
REFERENCES
[1] Security Advisory for Post-Authentication Command Injection &
Sensitive Information Disclosure on Multiple Products,
PSV-2021-0169 & PSV-2021-0171
https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171
[2] Netgear router flaws exploitable with authentication ... like the
default creds on Netgear's website
https://www.theregister.com/2021/12/03/netgear_router_flaws_patched/
[3] Netgear vulnerabilities could put small business routers at risk
https://www.immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/
[4] Responsible Disclosure
https://www.techanarchy.net/responsible-disclosure/
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYa2S6+NLKJtyKPYoAQhz2A//emZPq+4ZOJnWwoCfJL01upkqCyjpb8YL
Eed67n72efdSFIcuCr8aP6T3JhJ59v4qS24yl+pR5fkQKqALk1+dHl5CwYb5bmsX
427ShCfGDI1sUtKbvaemrSE0dl/ZGuY0sMr0BKoAmx6BwooongeuUkf3UCtHapkf
s9JRkN4/7neqSriJK6JCHnFf+1xh58rUvsaOXHfXMfECfUgh7iE7IkCybGsRp/8C
a9G0tRY0CdVRcoUyTRt1uvarYp+t43isg2YE+bGRzCKv+NPi5OuMJZ4m0keLdzAq
Mu0T3SZh7cpP5TFnVjTMk9z4XMu6JaUI93lYJVTNnNK96OBO9p8I1R6duuAccVo7
WMmfYpBwVCRrD9RFkLncQuA2uaLSuBIRzM1sTmIetqbB97sT6s3X9xc9DqGgBv4Q
L2N3lq1cjK1qvZpWJwzn5f916PctLAB86Q7lLMm+YdvC8eEPzN/iwZKuyb/efQvH
t+y7bALyWCU/p4J1MtRkIxgnQ87wqXBWseg7oAS81fnf72NYpZVN5Xjl4rUYJT4F
s9iJVhxAJFyznSQyN9OKI0Yj+25+z0IcCyMf+ldCHw7BWWTji1FsskHCjDOOdK1Q
BhksuFC6PzBtgl+JSxOvRDVsyF81fgjJHjI0KwehRWllN2/jNmAkSHGyjWxCZg5a
oMeZFLppD6A=
=LMZw
-----END PGP SIGNATURE-----