Netgear pushes out beta firmware for vulnerable router models

Netgear has confirmed that eight of its router models are vulnerable to device hijacking due to a vulnerability that can be easily exploited by remote, unauthenticated attackers.

The vulnerability allows the execution of Linux commands if they are appended to the URL of a page that the victim is tricked into visiting. The appended commands are execute with root privileges, and through them the attackers can make the device do pretty much anything they want to.

Router models confirmed to be affected are as follows: R6250, R6400, R6700, R7000, R7100LG, R7300, R7900, and R8000. The list could be expanded, as the company is still reviewing their entire router portfolio for the existence of the flaw.

Netgear has also provided, as a temporary solution, a beta version of the firmware that will be released in the following days and will fix the flaw.

“This beta firmware has not been fully tested and might not work for all users,” the company warned, and advised all users to download the production (final) version of the firmware release as soon as it is made available.

The beta version of the firmware is currently available for the R6400, R7000, and R8000 models.

There is no mention of reports of the vulnerability being exploited in attacks in the wild. But, as the exploit has been publicly disclosed, chances are good it is.

If you’re not confortable testing the beta firmware, you can still mitigate the risk of your device being compromised by terminating the web server process on your router (and repeating the process if the router is restarted).

UPDATE (December 14, 2016): Netgear has confirmed that four more router models are vulnerable – R6900, D6220, D6400, and D7000 – and has offered more beta firmware.