back to article WTF is your problem, Netgear? Another hijack hole found in its routers

Researchers are warning of a serious security hole that can be exploited to hijack potentially hundreds of thousands of Netgear routers. The programming blunder allows an attacker with access to the router to harvest the administrator access password. A victim could visit a malicious webpage that uses JavaScript to exploit the …

  1. AJames

    Already fixed?

    I followed the link from this article to the bug description page at Netgear to the update page for my R6300v2 router, only to find that it says this bug was apparently fixed already in the firmware update I installed at the end of December (V1.0.4.6_10.0.76). I see that the bug report numbers are dated 2017, so how is it that they were supposedly already fixed in earlier firmware?

    1. MrDamage

      Re: Already fixed?

      Responsible disclosure perhaps?

      Give Netgear enough time to check, fix, test, recheck, refix and retest, produce an update, and then disclose the bug.

    2. Parax

      Re: Already fixed?

      The article says

      "Netgear has released a fix for the update, though Kenin says that getting the network hardware giant to pay attention to the report was a nine-month ordeal "

    3. Charles 9 Silver badge

      Re: Already fixed?

      Same here for my R7000.

    4. joed

      Re: Already fixed?

      I guess this issue is with some newer Netgear routers. The only password recovery option for mine (that I'm aware of) is the hole in the back of the case (accepting metal pin). Maybe some of newer, cloud enabled "smart" routers that I'd not touch. Home router better be simple and did not require sign-in to somebody's cloud.

      1. Down not across Silver badge

        Re: Already fixed?

        I guess this issue is with some newer Netgear routers. The only password recovery option for mine (that I'm aware of) is the hole in the back of the case (accepting metal pin).

        Appears so. I just checked on old WNDR3700 with V1.0.4.68 firmware (never used as a router, but just as an access point) and whilst failing to authenticate does result in page produced by unauth.cgi, there is no tokens or anything like that. Likewise passwordrecovered.cgi does not exist (results in 404).

  2. Christian Berger Silver badge

    The problem is rather simple

    Netgear probably doesn't write the code running on their routers, they get the code from the chipset vendors and then reskin it. So they decide on a chipset, and while the hardware is being developed, they re-skin the firmware of the vendor. Any updates coming out since then will simply be ignored.

  3. Voland's right hand Silver badge

    WTF is your problem, Netgear?

    WTF is your problem, Netgear? - it is Netgear. That's all.

  4. Korev Silver badge
    Facepalm

    Recomended SoHo router

    I've pretty much lost confidence in Netgear's attitude to security and I'm thinking of getting rid of my R7000; what's the best AC router for SoHo use these days?

    1. pLu

      Re: Recomended SoHo router

      PC Engines APU2 + UniFi AP AC.

    2. Voland's right hand Silver badge

      Re: Recomended SoHo router

      Anything that can run openwrt and install openwrt.

      I usually buy Tp-Link (after checking that it is supported on OpenWRT website).

      1. YourNameHere

        Re: Recomended SoHo router

        I've been testing out the new Peplink Soho for my office and it's looking pretty good.

        https://www.peplink.com/products/pepwave-surf-soho/

    3. Paul Woodhouse

      Re: Recomended SoHo router

      I do quite like Drayteks...

    4. Christian Berger Silver badge

      Re: Recomended SoHo router

      If you want a "setup and forget" solution, look at a Fritz!Box. Those have auto update.

  5. Anonymous Coward
    Boffin

    Consumer products are mediocre

    Most consumer product is build as cheaply as possible, hacked together software running on low cost hardware, , which is reflected in the price. As in power tools there are cheap home versions (consumer grade) of the more expensive version sold to the commercial sector (industry grade).

  6. TeeCee Gold badge
    Facepalm

    The internet problem.

    Your device's security was tested by half-a-dozen people working to a tight deadline.

    Your device's security will be tested by thousands of people with nothing better to do until you throw it away...

  7. An nonymous Cowerd

    I recently upgraded from Asus to Apple, throughput went up, availability went up!

    (hanging off a long distance 802.11A/WiMax mountain top ISP-company in the alps)

    this shiny 2013 Extreme does do AC quite well, limit of about 50 clients, and I was able to find it refurb - Apple are about to drop making new ones, according to rumors. AMZN currently has them for £159.

    Strangely, my ISP (often) cut my RT-AC56U off as it was pinging for NTP 'too-much' in their opinion, the previous Asus RT-N16 was perfect - but was taken out by the EMP of lightning hitting something in the garden.

    1. Charles 9 Silver badge

      That wouldn't be EMP that killed your router but a power surge. Lightning, even just in close proximity, can fry a lot of electronics, even WITH protection.

  8. Mad Chaz

    Not for everyone

    But personally, I use pfSense. In my case, inside a VM on the computer I use as my home server. But any old/small/underpowered computer with 2 NIC can run it really.

    It's just not the kind of thing most people want to use.

  9. Richard Boyce

    Default port numbers

    This is a reminder to use non-default port numbers for services such as remote management. This will sometimes prevent zero-day expliots as well as provide a little protection for those who are slow to patch.

    1. Tom 64
      Windows

      Re: Default port numbers

      It may be worthwhile to resort to that, but only if you cannot turn off the external interface.

      Not exposing your admin interface to every hacker out there is a much better idea.

  10. JustNiz

    Here's your best option if your hardware supports it:

    http://wiki.openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=netgear

    1. Charles 9 Silver badge

      Trouble is, support is incomplete. Can't use it for my R7000, for example, because it OpenWRT can't drive the wireless chips. It's an issue common with FOSS because wireless chips are fiercely guarded trade secrets owing to wireless patents and competition (Linux has similar WiFi issues).

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019