79 Netgear router models are vulnerable to a severe unpatched security vulnerability that can be exploited by remote attackers to take over devices.
Security experts Adam Nichols from GRIMM and d4rkn3ss from the Vietnamese internet service provider VNPT have independently reported a severe unpatched security vulnerability that affects 79 Netgear router models.
The flaw could allow remote attackers to execute arbitrary code as “root” on the vulnerable devices and potentially take over them. The security experts reported the vulnerability to the vendor early this year.
A whopping 79 Netgear router models are vulnerable to a severe security flaw that can let hackers take over devices remotely.
Nichols discovered that the vulnerability affects 758 different firmware versions that run on 79 Netgear routers. Oldest firmware versions have been released as far back as 2007.
The researcher was analyzing Small Office/Home Office (SOHO) devices and focused its auditing session on the Netgear R7000 router.
The expert discovered the vulnerability in the web server component that is implemented in vulnerable Netgear router firmware.
“In SOHO devices like the R7000, the web server must parse user input from the network and run complex CGI functions that use that input. Furthermore, the web server is written in C and has had very little testing, and thus it is often vulnerable to trivial memory corruption bugs. As such, I decided to start by analyzing the web server, httpd.” reads the analysis published by GRIMM. “However, poor code quality and a lack of adequate testing has resulted in thousands of vulnerable SOHO devices being exposed to the internet for over a decade.”
GRIMM also discovered that the web server used in the router fails in validating the input provided by the user, lack of stack cookies, and the server’s binary is not compiled as a Position-independent Executable (PIE) failing to implement the ASLR (address space layout randomization) security technique.
Hackers could exploit the above issues by sending specially crafted malicious HTTP requests. Nichols also published a proof-of-concept exploit that automatically determines the SOHO device model/version and then exploit it to start telnet on TCP Port 8888.
Both Nichols and d4rkn3ss have now shared details about the flaw via the Zero-Day Initiative after having agreed with Netgear to give it the time to understand the impact of the issue on all its models.
It seems that the vendor requested a second extension until the end of June, but ZDI declined the request and notified the vendor the case would be published as 0-day on 06/15/20.
The bad news is that the vendor also will address the flaw for some of the affected routers because some families of devices have already reached the end-of-life.
Below is the list of all the affected models.
AC1450D6220D6300D6400D7000v2D8500DC112ADGN2200DGN2200v4DGN2200MDGND3700EX3700EX3800EX3920EX6000EX6100EX6120EX6130EX6150EX6200EX6920EX7000LG2200DMBM621MBR624GUMBR1200MBR1515MBR1516MBRN3000MVBR1210CR4500R6200R6200v2R6250R6300R6300v2R6400R6400v2R6700R6700v3R6900R6900PR7000R7000PR7100LGR7300R7850R7900R8000R8300R8500RS400WGR614v8WGR614v9WGR614v10WGT624v4WN2500RPWN2500RPv2WN3000RPWN3100RPWN3500RPWNCE3001WNDR3300WNDR3300v2WNDR3400WNDR3400v2WNDR3400v3WNDR3700v3WNDR4000WNDR4500WNDR4500v2WNR834Bv2WNR1000v3WNR2000v2WNR3500WNR3500v2WNR3500LWNR3500Lv2XR300
ZDI provided the following mitigation for the issue:
“Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it.” reads the ZDI’s advisory. “This could be accomplished in a number of ways, most notably with firewall rules/whitelisting.”
window._mNHandle = window._mNHandle || {};
window._mNHandle.queue = window._mNHandle.queue || [];
medianet_versionId = “3121199”;
try {
window._mNHandle.queue.push(function () {
window._mNDetails.loadTag(“762221962”, “300×250”, “762221962”);
});
}
catch (error) {}
Pierluigi Paganini
(SecurityAffairs – routers, SOHO)
The post 79 Netgear router models affected by a dangerous Zero-day appeared first on Security Affairs.