Thousands of Netgear Wi-Fi routers need to be patched now — here's how

1. Home
2. News
3. Security

Thousands of Netgear Wi-Fi routers demand to be patched at present — here's how

(Prototype credit: Netgear)

It'due south time to update your Netgear Wi-Fi router once again. The habitation-networking-device maker has pushed out security updates for 35 different models of routers, Wi-Fi range extenders and combination modem-routers to fix three flaws discovered by British security firm Immersive Labs.

2 of the Netgear router flaws let an attacker, who already has access to the router's administration interface, hack it to change configuration settings. Those new settings could then be used to create backdoors that would requite hackers permanent remote admission to the router'south controls.

In one case a hacker has control of your router, they tin run into and control where y'all go along the net and can often run into what you lot're receiving and sending.

To be fair, but getting access to the administration interface in the first identify pretty much means game over already, but this is a serious flaw that needs to be stock-still nonetheless.

Another Netgear router flaw lets someone on the local network get the router'south series number by querying a specific "port," or network interface.

Unremarkably, this wouldn't be and then bad, just as Immersive Labs researcher Kev Breen explained in a company web log post yesterday (Dec. 2), "this series number is used every bit part of the [authoritative] countersign reset function on most Netgear devices."

"This mechanism is supposed to ensure only those with physical access to the device tin reset the password," Breen added, because ordinarily the serial number is visible merely on a sticker on the  concrete device. "Armed with this information, it is now possible for any user on the network to animate being-forcefulness the password-reset questions."

This less-serious attack require local network access, but that's not as hard to go as it seems for an attacker. Many home-network Wi-Fi admission passwords can exist guessed or brute-forced. If malware sneaks onto a reckoner, smartphone, gaming console or smart device in the home by other ways, then it will have local network access as well.

How to update your Netgear Wi-Fi router'southward firmware

Updating Netgear routers to the latest firmware depends on the model. Many newer Netgear routers accept automatic updates enabled by default, and you'll just need to make certain the feature is turned on.

With some others, you have to go to the administrative interface and manually cheque for updates, which the router can and then download and install itself. Many of the models affected past these flaws also support the Netgear Nighthawk mobile app, which lets you check for and install router firmware correct from your smartphone.

Older models may require a more than complicated router-update procedure that involves going to the Netgear support website, entering the router's model number (it'south printed on a sticker on the device itself), going to that model'due south support page, checking for firmware updates, downloading the update file to a Mac or PC, and and so uploading the file to the router through the administrative interface.

If you need to go to the Netgear router authoritative console, you can usually reach it at http://198.168.1.1 in a spider web browser if you're on the router's local network. Some Netgear routers also permit you lot apply http://routerlogin.com or http://routerlogin.net.

In general, the username for the Netgear router administrative interface is "admin." You can alter that if yous like, but it's much more than important to make sure that the countersign for the authoritative interface has been inverse from the default password.

Default passwords for virtually home Wi-Fi routers, whether made by Netgear or not, can easily be establish online. Leaving yours as is just makes y'all a sitting duck for hackers.

While yous're in your router's administrative settings, you'll want to go to the "Advanced" office of the interface, then look for "Avant-garde Setup." Click on UPnP and make sure it's disabled.

Then click on "Spider web Services Management" or "Remote Management" and disable that as well. Doing so will remove 2 common channels of attack that hackers often use to attack routers.

Netgear Wi-Fi routers that need to exist updated

Following are two lists of Netgear devices, listed by model number, that need to be updated. The firmware version number listed is the version that fixes these flaws. Yous tin can meet the version number of the firmware that your own router is running in the height right corner of the administrative interface.

Eighteen Netgear Wi-Fi routers, range extenders and combination modem-routers are vulnerable to the first ii flaws above, which lets an attacker change a router'southward configuration settings. (Both versions of the RAX120 may also exist vulnerable to other Wi-Fi router flaws disclosed by different researchers this week.)

DSL Modem Routers

• D7800 stock-still in firmware version ane.0.ane.66

Wi-Fi Range Extenders

• EX2700 fixed in firmware version 1.0.1.68
• WN3000RPv2 fixed in firmware version 1.0.0.90
• WN3000RPv3 stock-still in firmware version 1.0.2.100

LTE Modem Routers

• LBR1020 (an Orbi wireless broadband gateway) fixed in firmware version 2.6.5.20

Orbi Wi-Fi Systems

• LBR20 fixed in firmware version 2.6.five.32

Wi-Fi Routers

• R6700AX fixed in firmware version one.0.10.110
• R7800 fixed in firmware version one.0.2.86
• R8900 stock-still in firmware version 1.0.five.38
• R9000 stock-still in firmware version 1.0.5.38
• RAX10 fixed in firmware version 1.0.10.110
• RAX120v1 fixed in firmware version 1.2.three.28
• RAX120v2 fixed in firmware version 1.2.3.28
• RAX70 fixed in firmware version 1.0.10.110
• RAX78 fixed in firmware version 1.0.ten.110
• XR450 fixed in firmware version 2.3.two.130
• XR500 fixed in firmware version ii.3.2.130
• XR700 fixed in firmware version i.0.1.46

Seventeen Netgear Wi-Fi router models are vulnerable to the third flaw, which makes the device serial number visible.

Wi-Fi Routers

• AC2100 stock-still in firmware version 1.ii.0.88
• AC2400 fixed in firmware version 1.two.0.88
• AC2600 fixed in firmware version 1.ii.0.88
• D7000 fixed in firmware version 1.0.ane.82
• R6220 stock-still in firmware version 1.ane.0.110
• R6230 stock-still in firmware version 1.1.0.110
• R6260 fixed in firmware version 1.one.0.84
• R6330 fixed in firmware version 1.1.0.84
• R6350 fixed in firmware version 1.1.0.84
• R6700v2 stock-still in firmware version 1.2.0.88
• R6800 fixed in firmware version 1.2.0.88
• R6850 fixed in firmware version 1.1.0.84
• R6900v2 fixed in firmware version 1.ii.0.88
• R7200 fixed in firmware version 1.2.0.88
• R7350 stock-still in firmware version ane.2.0.88
• R7400 fixed in firmware version 1.two.0.88
• R7450 fixed in firmware version 1.two.0.88

Paul Wagenseil is a senior editor at Tom'southward Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-booty driver, lawmaking monkey and video editor. He's been rooting around in the information-security space for more than than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random Television set news spots and even moderated a panel discussion at the CEDIA home-applied science conference. You tin follow his rants on Twitter at @snd_wagenseil.

Source: https://www.tomsguide.com/news/netgear-security-patches-dec21

Posted by: kwonfordlbeatink.blogspot.com

Share this post