Hundreds of thousands, if not over a million Netgear routers open to hack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-5521 | Password Disclosure Flaw in NETGEAR R7000, R6400, R6700, R8500 and Other Routers NETGEAR routers across many popular models leak the admin password through a flaw in the web management interface's password recovery flow. When a visitor cancels the login prompt and password recovery is not enabled, the router exposes a password recovery token, and requesting /passwordrecovered.cgi?id=TOKEN with that token returns the router's admin password; the flaw is reachable remotely when the remote management option is enabled, and also from the LAN or WLAN. An attacker who obtains the password gains full administrative control of the router. Owners of the affected NETGEAR models are exposed, and the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-08 with a public proof-of-concept available and an EPSS exploitation probability of ~89%, indicating active exploitation. Do: Apply firmware updates per NETGEAR's instructions; if an affected router has reached end-of-life, disconnect or replace it. As an interim mitigation, disable remote web management if it is not required, and note that enabling password recovery once (setting security questions) permanently blocks this exploit even if the option is later disabled. Administrators should check whether the web panel at /passwordrecovered.cgi exposes credentials when authentication is canceled. | 8.1 | 89% | KEV PoC |
| masshundreds of thousands to over 1 million internet-exposed NETGEAR routers |
Full article531 words · extracted from securityaffairs.com · click to collapse
Hundreds of thousands of Netgear routers are vulnerable to password bypass, the company issued updates only for a number models.
An impressive number of Netgear routers is affected by two flaws that can lead to password disclosure.
It has been estimated that hundreds of thousand devices, potentially more than one million Netgear routers, could be hacked, by both a local or a remote attacker.
Simon Kenin, a security researcher at Trustwave, discovered the flaw and confirmed the vulnerabilities can be remotely exploited when the remote management option of the Netgear routers is enabled.
While Netgear claims remote management is turned off on routers by default,
Kenin explained that despite Netgear claims remote management is turned off on routers by default, there are “hundreds of thousands, if not over a million” Netgear routers with the feature turned on.
Hacking the Netgear routers by exploiting this password bypass it is quite simple, attackers just need to send a simple request to the web management server running on the device.
In this way the expert is able to determine a number that corresponds to a password recovery token, then he could use it to call the passwordrecovered.cgi script.
Kenin discovered by the password bypass by leveraging two exploits disclosed in 2014 on some Netgear routers.
“After few trials and errors trying to reproduce the issue, I found that the very first call to passwordrecovered.cgi will give out the credentials no matter what the parameter you send. This is totally new bug that I haven’t seen anywhere else. When I tested both bugs on different NETGEAR models, I found that my second bug works on a much wider range of models.” Kenin wrote in a blog post.
“A full description of both of these findings as well as the python script used for testing can be found here. The vulnerabilities have been assigned CVE-2017-5521 and TWSL2017-003.”
Trustwave reported the vulnerability to Netgear in April 2016, but Netgear only in in July provided firmware updates for a fraction of the affected router models.
This week Netgear published detailed instructions on the affected models and the way to download and install firmware updates. According to the security advisory, there are 31 vulnerable models, but only 18 of them have been patched.
The owners of the unpatched devices have to manually enable password recovery and disable remote management on their Netgear routers in order to avoid problems.
“The potential for password exposure remains if you do not complete both steps. NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notification,” the company writes.
Kenin points out the dangers caused by malware like the Mirai bot that once obtained a login credential for the routers could cause serious problems.
“With malware such as the Mirai botnet being out there, it is also possible that some of the vulnerable routers could be infected and ultimately used as bots as well. If running a bot is not possible, the DNS can be easily changed to a rogue one, as described by Proofpoint, to further infect machines on the network,” Kenin added.
[adrotate banner=”9″]
(Security Affairs – Netgear, routers)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/55829/iot/netgear-routers-flaw.html