New vulnerability exploits password recovery system on Netgear routers & modems
Most of Netgear's home and small business router and modem models are affected by a vulnerability in their password recovery system, which could potentially let a hacker assume control or install a botnet, according to a security firm.
An attack would normally require physical access but could be delivered via the internet if a person flips remote management on, Trustwave explained. That option is typically off by default.
The scale of the threat could be significant, since Trustwave said that it has discovered over 10,000 remotely accessible units, and estimates that the real number could be "in the hundreds of thousands, if not over a million."
The issue has already been submitted to the U.S. government's National Vulnerability Database, and acknowledged by Netgear, which has put up a list of exposed models. The company has also issued updated firmware which should close the vulnerability, but only on some devices.
The full list of patched hardware includes:
In December a vulnerability was uncovered that could subject some Netgear routers to a command injection attack, simply after visiting a malicious website. That vulnerability also remains unpatched on some hardware as well.
Apple's routers remain safe from this, and nearly all other, exploits. However, the future of the AirPort line is unclear with Apple reportedly making moves to disband the stand-alone Airport hardware division, and reassigning the engineers to other departments.
The internal departmental changes suggest that Apple has no plans to update its existing lineup of routers, including the AirPort Extreme, Time Capsule, and AirPort Express, but do not discount the possibility of the functionality being added to a different product. Apple's AirPort Express network extender and AirPlay audio target has not even been updated to the 802.11ac Wi-Fi specification.
Without specifically confirming the dissolution of the AirPort hardware division, AppleInsider was told by our contacts within Apple corporate that the AirPort ecosystem back to the 802.11n version of the AirPort Extreme basestation would be made "as safe as possible for as long as possible."
An attack would normally require physical access but could be delivered via the internet if a person flips remote management on, Trustwave explained. That option is typically off by default.
The scale of the threat could be significant, since Trustwave said that it has discovered over 10,000 remotely accessible units, and estimates that the real number could be "in the hundreds of thousands, if not over a million."
The issue has already been submitted to the U.S. government's National Vulnerability Database, and acknowledged by Netgear, which has put up a list of exposed models. The company has also issued updated firmware which should close the vulnerability, but only on some devices.
The full list of patched hardware includes:
- R8500
- R8300
- R7000
- R6400
- R7300DST
- R7100LG
- R6300v2
- WNDR3400v3
- WNR3500Lv2
- R6250
- R6700
- R6900
- R8000
- R7900
- WNDR4500v2
- R6200v2
- WNDR3400v2
- D6220
- D6400
- C6300 (available via ISPs)
- R6200
- R6300
- VEGN2610
- AC1450
- WNR1000v3
- WNDR3700v3
- WNDR4000
- WNDR4500
- D6300
- D6300B
- DGN200Bv4
- DGN2200v4
In December a vulnerability was uncovered that could subject some Netgear routers to a command injection attack, simply after visiting a malicious website. That vulnerability also remains unpatched on some hardware as well.
Apple's routers remain safe from this, and nearly all other, exploits. However, the future of the AirPort line is unclear with Apple reportedly making moves to disband the stand-alone Airport hardware division, and reassigning the engineers to other departments.
The internal departmental changes suggest that Apple has no plans to update its existing lineup of routers, including the AirPort Extreme, Time Capsule, and AirPort Express, but do not discount the possibility of the functionality being added to a different product. Apple's AirPort Express network extender and AirPlay audio target has not even been updated to the 802.11ac Wi-Fi specification.
Without specifically confirming the dissolution of the AirPort hardware division, AppleInsider was told by our contacts within Apple corporate that the AirPort ecosystem back to the 802.11n version of the AirPort Extreme basestation would be made "as safe as possible for as long as possible."
Comments