• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

HUGE exploit in Netgear Nighthawk and other routers, accessed by browsing the web

Status
Not open for further replies.
M

Marty Chinn

Member
I know this got posted yesterday but with only one reply, it seems to have gone unnoticed so I'm posting it again with hopefully a better eye catching title since it's a huge backdoor. I know the Netgear Nighthawk R7000 is a widely used router around here and is often recommended and it's one of the affected ones.

Andrew Rollins, a security researcher who also goes by Acew0rm, notified Netgear about the flaw on August 25, but says that the company never responded to him. After waiting more than three months, he went public with the vulnerability, and the Department of Homeland Security’s CERT group released an advisory about it on Friday. Its advice? Pull the plug.
Click to expand...

“Exploiting this vulnerability is trivial. Users who have the option of doing so should strongly consider discontinuing use of affected devices until a fix is made available,” the CERT notice said. The flaw allows unauthenticated web pages to access the command-line and then execute malicious commands, which could lead to total system takeover.
Click to expand...

After initially saying over the weekend that three products “might be vulnerable,” Netgear now confirms that eight of its router models (R6250, R6400, R6700, R7000, R7100LG, R7300, R7900, R8000) are affected, including three of the five most popular routers on Amazon. Netgear also declined to comment on why it’s taking so long to release a production-grade firmware update.”We strive to earn and maintain the trust of those that use Netgear products for their connectivity,” the company said in a statement.
Click to expand...

https://www.wired.com/2016/12/ton-popular-netgear-routers-exposed-no-easy-fix/

Here's the link to the beta patched firmware.

http://kb.netgear.com/000036386/CVE-2016-582384

Here's also the link to the original thread which went unnoticed:

http://www.neogaf.com/forum/showthread.php?t=1324951
 
T

Timedog

good credit (by proxy)
There's about a zero percent chance that this was only found a few months ago for the first time.
 
N

newshinycd

Member
Ha. I bought a new router last year, and I got some shit from coworkers because I went with an Asus router instead of Nighthawk.
Looks like they'll be eating crow tonight.
 
W

WorldStar

Banned
newshinycd said:
Ha. I bought a new router last year, and I got some shit from coworkers because I went with an Asus router instead of Nighthawk.
Looks like they'll be eating crow tonight.
Click to expand...
The nighthawk is generally considered one of the best routers out there

Which is why this is so surprising
 
Audioboxer

Audioboxer

Member
Terrible response time from Netgear :( Just updated my R7000. I use it for wireless (piggybacks off another modem for connecting to Sky) and because I have a 5TB hard drive attached for media.
 
M

Magnus

Member
Damn it, ours is the R7000. My boyfriend paid a buttload for that router too.

How serious is this really? Like, do I need to actually unplug and stop using the thing today?
 
G

Gurgelhals

Member
There's a reason why people should either use these things with some third-party open source firmware such as DD-WRT or switch over to prosumer-grade stuff such as Ubiquiti altogether.

A router is usually sitting at what is by far the most vulnerable spot of every home network. This fact alone should make you not want to run them on your run-of-the-mill consumer-grade software where keeping development costs as low as possible always trumps concerns about security and stability.
 
P

pestul

Member
Okay, so the survey company I do tech support for uses the R6300.. it's not on the list of effected routers, but I don't trust them.
 
R

RS4-

Member
Is it one of the best because of these backdoors :eek:

Almost bought one last year, got the Archer instead.
 
S

Syriel

Member
onadesertedisland said:
So is this a backdoor or an NSA thing?
Click to expand...

This is more of an engineering oops thing. There's no reason the web server should be running commands as an admin like that.

Magnus said:
Damn it, ours is the R7000. My boyfriend paid a buttload for that router too.

How serious is this really? Like, do I need to actually unplug and stop using the thing today?
Click to expand...

Anyone on your network can run any CLI commands they choose on the router.
 
B

Belker

Member
I had no idea this was a problem. Thanks for sharing the info. I've updated my router with the beta patch and tweeted a link to the article.
 
Dr. Zoidberg

Dr. Zoidberg

Member
Well shit. I've been very happy with my R7000 since I've had it. My co-worker got the oft-recommended ASUS and has had a lot of problems. I guess it's my turn now. I'll install the beta firmware tonight. I've dealt with DD-WRT before and liked it, so that's another possibility.
 
M

Marty Chinn

Member
marc^o^ said:
How would any hacker know one has such a router?
Click to expand...

They wouldn't. They gain access by you going to a website. When you connect to that website, it can then send commands via that exploit to your router and gain access. So they don't come to you, you go to them without realizing it because all you did was browse the web.
 
C

CDX

Member
People have a router capable of putting DD-WRT, Tomato, or Open-WRT or some other firmware on it, BUT they just keep the manufactures firmware on it?

I find that odd, because It seems like in my circle of friends, nearly everybody has one of those firmwares listed above on their router.

But I guess now that I think about it, it shouldn't be odd that most will just stick with whatever firmware the manufacturer gives them. That's probably what the vast majority do.
 
J

jstripes

Banned
CDX said:
People have a router capable of putting DD-WRT, Tomato, or Open-WRT or some other firmware on it, BUT they just keep the manufactures firmware on it?

I find that odd, because It seems like in my circle of friends, nearly everybody has one of those firmwares listed above on their router.

But I guess now that I think about it, it shouldn't be odd that most will just stick with whatever firmware the manufacturer gives them. That's probably what the vast majority do.
Click to expand...

Does your circle of friends happen to be tech savvy?

Most people don't even know you can update the manufacturer's firmware.
 
Status
Not open for further replies.

Similar threads

  • Locked
Netgear router security vulnerability
1
2K
Nilaul replied
Top Bottom