Some Netgear Routers Need to Be Patched Immediately(pcmag.com)
pcmag.com
Some Netgear Routers Need to Be Patched Immediately
https://www.pcmag.com/news/thanks-to-disney-11-netgear-routers-need-to-be-patched-immediately
9 comments
Even further its only those routers with the `circled` process running, which apparently is part of the parental controls functionality provided by Circle with their NetGear partnership. The silly part too is that the attack surface is available even if you don't have parental controls enabled.
I'm so glad I've been playing around with OpenWRT lately. I bought a second router a while back just to experiment with it and now I have automatic fail-over between two ISPs (with mwan3) and WPA2 Enterprise (with FreeRadius).
Needless to say, my Netgear R7000P will soon be decommissioned. I wish it were officially supported on OpenWRT because it's got a good amount of RAM and flash that could have been put to better use.
Needless to say, my Netgear R7000P will soon be decommissioned. I wish it were officially supported on OpenWRT because it's got a good amount of RAM and flash that could have been put to better use.
Looks like the 7000P is supported by DD-WRT if you want something to play with before binning it: https://forum.dd-wrt.com/wiki/index.php/Netgear_R7000P
For the longest time I used my R7000 as a router and NAS with either AsusWRT-Merlin or FreshTomato. They might serve your purpose?
Thoughts on which to choose for R7000?
FreshTomato vs DD-WRT vs others?
https://kb.netgear.com/000064039/Security-Advisory-for-Remot...
This link covers more the actual article.
TLDR: RCE on R6400v2 R6700 R6700v3 R6900 R6900P R7000 R7000P R7850 R7900 R8000 RS400
This link covers more the actual article.
TLDR: RCE on R6400v2 R6700 R6700v3 R6900 R6900P R7000 R7000P R7850 R7900 R8000 RS400
Why the hell do I have to manually download the new firmware and deploy it to fix this? My Netgear router has usually been able to update itself in the past just by logging into the admin console and checking for new firmware updates.
Their update is weird. Sometimes it does it by itself, but other times I've found that it had refused to update for almost a year.
Thats definitely a massive problem because anyone with access to DNS records (ISPs, governments, educational facilities, and so on) can remotely hack all of these devices, but on the other hand this poses no direct threat. The "immediately" part of the title seems overstated.
This just seems like a random, run-of-the-mill crappy router vulnerability to me. I'd be surprised if there was a consumer router that wasn't vulnerable to this somehow. Good thing Netgear provides a patch, though.