Partner Nintendo 3DS Central Social

Stop using Netgear routers with unpatched security bug, experts warn

froggyboy604

froggyboy604

Well-Known Member
Staff member
Manager
Full GL Member
28,665
2007
758
Awards
20
Credits
9,872
Mature Board Viewing
Unlock full profile styling
A variety of Netgear router models are vulnerable to a simple hack that allows attackers to take almost complete control of the devices, security experts warned over the weekend.

The critical bug allows remote attackers to inject highly privileged commands whenever anyone connected to the local Netgear network clicks on a malicious Web link, a researcher who uses the online handle Acew0rm reported on Friday. The link, which can be disguised to appear innocuous, then injects a command that routers run as root. The devices' failure to properly filter out input included in Web requests allows attackers to run powerful shell commands. Netgear R7000, R6400, and R8000 models have been confirmed to be vulnerable, and other models, including the R7000P, R7500, R7800, R8500 R9000, have been reported by end users as being affected.

"Exploiting this vulnerability is trivial," officials with CERT, the federally funded vulnerability coordination service, warned in an advisory published Friday. "Users who have the option of doing so should strongly consider discontinuing use of affected devices until a fix is made available."

A temporary fix is also possible. Ironically, it involves exploiting the vulnerability in a safe way to issue a command that turns off the router's Web server. The command can be issued by clicking on a simple link similar to this one (http://[router-address]/cgi-bin/;killall$IFS'httpd'), where [router-address] is replaced with the local IP address assigned to the router.

Read More

This stinks for people who own Netgear routers which are affected by this securiy bug.
 
Back when I had netgear I would check for updates often but there was never any really.
 
Demon_Skeith said:
Back when I had netgear I would check for updates often but there was never any really.
Click to expand...

I notice most routers I own don't have many updates. I think one of the reasons for routers not having many updates is because router makers don't want people to accidentally brick their router if the updates take too long, and they unplug the router during the update which can break their router.

A lot of router makers also warn users not to update their router if the router is working well.

Many routers may use a modified version of free router firmware like DD-WRT because the router maker does not want to hire someone to program a custom router firmware which can be more expensive and insecure than using a free router firmware.
 
2045 said:
I've never even heard about this brand of routers...
Click to expand...

Netgear is pretty popular with more tech savvy users in North America. But, I think D-Link, and Linksys are more well known router brands with regular buyers because D-Link and Linksys is found in more stores, and ads.
 
Demon_Skeith said:
Can't really think the last I've heard of D-Link routers.
Click to expand...

I think router Networking hardware brands in general are not very well known with most people unless the hardware is made by Google, and other very big brands which make other big products like Google Android, Google Search, etc.

Most people just seem to get routers which are cheap, or recommended to them by the staff at a store like Wal-Mart or Bestbuy. More people are also using built-in routers from their ISP's modem, so fewer people are buying routers from an online or offline store like Wal-Mart.
 
You must log in or register to reply here.
Back
Top