Netgear later confirmed the vulnerability was present in its R8000, R7000, and R6400 routers, but has not yet confirmed whether or not the R7000P, R7500, R7800, R8500, or R9000 models are also affected. According to the CERT report, users of any of the aforementioned routers should be cautious and should probably stop using the devices until a patch has been released.
The vulnerability is particularly insidious because of how simple it is to execute. According to Ars, the only thing you have to do as a user is to click on a malicious link, which can be easily disguised as something innocuous. The link then serves a set of instructions to your router, which will run the commands as a root user, allowing the malicious instructions to subvert your router’s security.
Even if your router’s remote management is disabled, or is otherwise insulated from the internet, the commands will still be run by vulnerable routers, giving malicious third parties access to your local network and all the traffic that passes through it. Ars originally reported a temporary workaround that would protect you from the exploit, and the vulnerability was so severe that the best bet was to just switch it off and keep an eye on the Netgear security advisories for this particular exploit.
Fortunately, Netgear has now responded with a firmware update for the affected routers, either a production update or a beta update. It’s highly recommended that you click on your Netgear router from the list below to download the new firmware:
- R6400 (production)
- R7000 (production)
- R8000 (production)
- R6250 (beta)
- R6700 (beta)
- R6900 (beta)
- R7100LG (beta)
- R7300DST (beta)
- R7900 (beta)
- D6220 (beta)
- D6400 (beta)
Netgear recommends in the strongest terms that you update your router. Download and install the beta software now, and then make sure to update to the production firmware when it’s available. Keep an eye on the Security Advisory page for vulnerability 582384 to see if any other Netgear routers are added to the list or if further updates are provided for the known vulnerable devices.
Updated on 12-19-2016 by Mark Coppock: Add download links for production and beta firmware for the affected Netgear routers.
