If you own one of these 45 Netgear devices, replace it: Firm won't patch vulnerable gear despite live proof-of-concept code
(2020/07/30)
- Reference: 1596108516
- News link: https://www.theregister.co.uk/2020/07/30/netgear_abandons_45_routers_vuln_patching/
- Source link:
Netgear has quietly decided not to patch more than 40 home routers to plug a remote code execution vulnerability – despite security researchers having published proof-of-concept exploit code.
The vuln was revealed publicly in June by Trend Micro's Zero Day Initiative (ZDI) following [1]six months spent chivvying Netgear behind the scenes to take it seriously .
Keen-eyed Reg readers, however, noticed that Netgear quietly declared 45 of the affected products as "outside the security support period" – meaning those items won't be updated to protect them against the vuln.
America's Carnegie-Mellon University [2]summarised the vuln in a note from its Software Engineering Institute: "Multiple Netgear devices contain a stack buffer overflow in the httpd web server's handling of upgrade_check.cgi, which may allow for unauthenticated remote code execution with root privileges."
Stung by pressure from infosec researchers that came to a head in June when ZDI went public, Netgear began issuing patches. It had [3]sorted out 28 of the 79 vulnerable product lines by the end of that month.
Infosec biz Grimm pitched in after independently discovering the vuln itself by [4]publishing proof-of-concept exploits for the SOHO (Small Office/Home Office) devices.
With today's revelation that 45 largely consumer and SME-grade items will never be patched, Netgear faces questions over its commitment to older product lines. Such questions have begun to be addressed in Britain by calls from government agencies for [5]new laws forcing manufacturers to reveal devices' design lifespans at the point of purchase.
Brian Gorenc, Trend Micro's senior director of vulnerability research and head of ZDI, told The Register in a statement: "Consumers should always ensure their devices are still supported by their manufacturers. They should also check the available support before purchasing a device. Unfortunately, there are too many examples of vendors abandoning devices that are still in wide use – sometimes even when they are still available to purchase. We hope vendors clearly communicate their support and lifecycle policies so that consumers can make educated choices."
Today Netgear's [6]advisory page for the patches shows 45 devices' fix status as "none; outside security support period". We have collected those devices' model numbers in the list below:
AC1450
D6300
DGN2200v1
DGN2200M
DGND3700v1
LG2200D
MBM621
MBR1200
MBR1515
MBR1516
MBR624GU
MBRN3000
MVBR1210C
R4500
R6200
R6200v2
R6300v1
R7300DST
WGR614v10
WGR614v8
WGR614v9
WGT624v4
WN2500RP
WN2500RPv2
WN3000RP
WN3000RPv2
WN3000RPv3
WN3100RP
WN3100RPv2
WN3500RP
WNCE3001
WNCE3001v2
WNDR3300v1
WNDR3300v2
WNDR3400v1
WNDR3400v2
WNDR3400v3
WNDR3700v3
WNDR4000
WNDR4500
WNDR4500v2
WNR3500v1
WNR3500Lv1
WNR3500v2
WNR834Bv2
The Register asked Netgear to comment some days ago but at the time of publication the company had not sent us a statement. ®
Get our [7]Tech Resources
[1] https://www.theregister.com/2020/06/19/netgear_bug_disclosure/
[2] https://www.kb.cert.org/vuls/id/576779
[3] https://www.theregister.com/2020/06/30/netgear_router_patches_28_of_79_done/
[4] https://blog.grimm-co.com/2020/06/soho-device-exploitation.html
[5] https://www.theregister.com/2020/01/28/uk_government_cracks_down_on_iot_security/
[6] https://kb.netgear.com/000061982/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Mobile-Routers-Modems-Gateways-and-Extenders
[7] https://whitepapers.theregister.com/
The vuln was revealed publicly in June by Trend Micro's Zero Day Initiative (ZDI) following [1]six months spent chivvying Netgear behind the scenes to take it seriously .
Keen-eyed Reg readers, however, noticed that Netgear quietly declared 45 of the affected products as "outside the security support period" – meaning those items won't be updated to protect them against the vuln.
America's Carnegie-Mellon University [2]summarised the vuln in a note from its Software Engineering Institute: "Multiple Netgear devices contain a stack buffer overflow in the httpd web server's handling of upgrade_check.cgi, which may allow for unauthenticated remote code execution with root privileges."
Stung by pressure from infosec researchers that came to a head in June when ZDI went public, Netgear began issuing patches. It had [3]sorted out 28 of the 79 vulnerable product lines by the end of that month.
Infosec biz Grimm pitched in after independently discovering the vuln itself by [4]publishing proof-of-concept exploits for the SOHO (Small Office/Home Office) devices.
With today's revelation that 45 largely consumer and SME-grade items will never be patched, Netgear faces questions over its commitment to older product lines. Such questions have begun to be addressed in Britain by calls from government agencies for [5]new laws forcing manufacturers to reveal devices' design lifespans at the point of purchase.
Brian Gorenc, Trend Micro's senior director of vulnerability research and head of ZDI, told The Register in a statement: "Consumers should always ensure their devices are still supported by their manufacturers. They should also check the available support before purchasing a device. Unfortunately, there are too many examples of vendors abandoning devices that are still in wide use – sometimes even when they are still available to purchase. We hope vendors clearly communicate their support and lifecycle policies so that consumers can make educated choices."
Today Netgear's [6]advisory page for the patches shows 45 devices' fix status as "none; outside security support period". We have collected those devices' model numbers in the list below:
AC1450
D6300
DGN2200v1
DGN2200M
DGND3700v1
LG2200D
MBM621
MBR1200
MBR1515
MBR1516
MBR624GU
MBRN3000
MVBR1210C
R4500
R6200
R6200v2
R6300v1
R7300DST
WGR614v10
WGR614v8
WGR614v9
WGT624v4
WN2500RP
WN2500RPv2
WN3000RP
WN3000RPv2
WN3000RPv3
WN3100RP
WN3100RPv2
WN3500RP
WNCE3001
WNCE3001v2
WNDR3300v1
WNDR3300v2
WNDR3400v1
WNDR3400v2
WNDR3400v3
WNDR3700v3
WNDR4000
WNDR4500
WNDR4500v2
WNR3500v1
WNR3500Lv1
WNR3500v2
WNR834Bv2
The Register asked Netgear to comment some days ago but at the time of publication the company had not sent us a statement. ®
Get our [7]Tech Resources
[1] https://www.theregister.com/2020/06/19/netgear_bug_disclosure/
[2] https://www.kb.cert.org/vuls/id/576779
[3] https://www.theregister.com/2020/06/30/netgear_router_patches_28_of_79_done/
[4] https://blog.grimm-co.com/2020/06/soho-device-exploitation.html
[5] https://www.theregister.com/2020/01/28/uk_government_cracks_down_on_iot_security/
[6] https://kb.netgear.com/000061982/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Mobile-Routers-Modems-Gateways-and-Extenders
[7] https://whitepapers.theregister.com/
Time to check how many on the list support DD/Open-WRT?
PTW
And to pick up a bargain on fleabay. In an effort to save waste/landfill obviously, not because I'm a tight git.
Edit to add: Mixed bag, some are, some aren't, see https://wiki.dd-wrt.com/wiki/index.php/Supported_Devices#Netgear
It'd be interesting
Anonymous Coward
... to see how old those de-supported routers on the list are (but not so interesting that I'd actually go to check them up)
I wonder
How many rebadged ISP-supplied routers are in that list.