^{CVE-2017-18749:}Cross-Site Request Forgery (CSRF) vulnerability in multiple NETGEAR router models allows attackers to execute unauthorized commands.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in numerous NETGEAR router models. This security issue allows attackers to trick authenticated users into executing unwanted actions on the router's web interface without their knowledge or consent. When a user with an active session on the router's administration interface visits a malicious website, the attacker can force the user's browser to send unauthorized requests to the router. These requests could potentially change router settings, create backdoor accounts, or modify network configurations. The vulnerability affects multiple NETGEAR router models including JNR1010v2, JR6150, JWNR2010v5, R6050, R6100, R6220, R7500, R7500v2, R7800, R9000, WNDR3700v4, WNDR3700v5, WNDR4300, WNDR4300v2, WNDR4500v3, WNR1000v4, WNR2000v5, WNR2020, and WNR2050 running firmware versions prior to those specified in the advisory.

Overview

This vulnerability (CVE-2017-18749) is a Cross-Site Request Forgery (CSRF) issue affecting multiple NETGEAR router models. CSRF attacks exploit the trust that a website has in a user's browser, allowing attackers to perform actions on behalf of authenticated users without their knowledge. In this case, the vulnerability could allow an attacker to:

• Change router administration passwords
• Modify network settings
• Alter DNS configurations
• Create unauthorized access points
• Disable security features

The attack typically works by embedding malicious code in a website that, when visited by a user who is currently logged into their router's administration interface, automatically sends commands to the router. Since the browser sends authentication cookies with these requests, the router processes them as legitimate commands from the authorized user.

Remediation

To address this vulnerability, NETGEAR has released firmware updates for all affected router models. Users should update their router firmware to the following versions or newer:

• JNR1010v2: Update to version 1.1.0.44 or later
• JR6150: Update to version 1.0.1.10 or later
• JWNR2010v5: Update to version 1.1.0.44 or later
• R6050: Update to version 1.0.1.10 or later
• R6100: Update to version 1.0.1.16 or later
• R6220: Update to version 1.1.0.50 or later
• R7500: Update to version 1.0.0.112 or later
• R7500v2: Update to version 1.0.3.20 or later
• R7800: Update to version 1.0.2.36 or later
• R9000: Update to version 1.0.2.40 or later
• WNDR3700v4: Update to version 1.0.2.88 or later
• WNDR3700v5: Update to version 1.1.0.48 or later
• WNDR4300: Update to version 1.0.2.90 or later
• WNDR4300v2: Update to version 1.0.0.48 or later
• WNDR4500v3: Update to version 1.0.0.48 or later
• WNR1000v4: Update to version 1.1.0.44 or later
• WNR2000v5: Update to version 1.0.0.58 or later
• WNR2020: Update to version 1.1.0.44 or later
• WNR2050: Update to version 1.1.0.44 or later

Additional security recommendations:

1. Always log out from the router's web interface after configuration changes
2. Use strong, unique passwords for router administration
3. Disable remote management if not needed
4. Consider implementing network segmentation for IoT devices
5. Regularly check for and apply firmware updates

References

1. NETGEAR Security Advisory: https://kb.netgear.com/000051505/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2016-0101
2. MITRE CWE-352 (Cross-Site Request Forgery): https://cwe.mitre.org/data/definitions/352.html
3. OWASP CSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html