Netgear has fixed a high-severity vulnerability affecting several models of Wi-Fi routers and advised customers to update their devices to the latest available firmware as soon as possible.

The flaw affects several Nighthawk Wireless AC, AX Nighthawk Wireless (Wi-Fi 6)and Wireless AC router models.

Although Netgear did not disclose any information about the component affected by this bug or its impact, it did state that it is a pre-authentication buffer overflow vulnerability.

The impact of a success dampen overflow Exploitation can range from crashes following a denial of service to arbitrary code execution, if the code execution is performed during the attack.

Attackers can exploit this flaw in low complexity attacks without requiring permissions or user interaction.

In a security advisory released Wednesday, Netgear said it “strongly recommends downloading the latest firmware as soon as possible.”

The list of vulnerable routers and patched firmware versions can be found in the table below.

Vulnerable Netgear Router Firmware version patched
RAX40 Firmware Version 1.0.2.60
RAX35 Firmware Version 1.0.2.60
R6400v2 Firmware version 1.0.4.122
R6700v3 Firmware version 1.0.4.122
R6900P Firmware version 1.3.3.152
R7000P Firmware version 1.3.3.152
R7000P Firmware version 1.0.11.136
R7960P Firmware Version 1.4.4.94
R8000P Firmware Version 1.4.4.94

How to Update Your Router Firmware

To download and install the latest firmware for your Netgear router, you need to follow these steps:

  1. Visit NETGEAR Support.
  2. Start typing your model number in the search box, then select your model from the drop-down menu when it appears.
  3. If you don’t see a drop-down menu, make sure you entered your model number correctly or select a product category to find your product model.
  4. Click on Downloads.
  5. Under Current releasesselect the first download whose title begins with Firmware version.
  6. Click on Release Notes.
  7. Follow the instructions in the firmware release notes to download and install the new firmware.

“The pre-authentication buffer overflow vulnerability persists if you do not follow all recommended steps,” Netgear also warned.

“NETGEAR is not responsible for consequences that could have been avoided by following the recommendations of this notification.”

A Netgear spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today for more information.

Wednesday, Netgear urged customers to address a second vulnerability that can be exploited to trigger a denial of service state in attacks targeting Wireless AC Nighthawk and Wireless AX Nighthawk (WiFi 6) routers.

Earlier this year, Netgear also fix bad Orbi firmware update which prevented customers from accessing the admin consoles of their devices.



Source link