Description Preview
A security vulnerability in certain NETGEAR router models allows unauthorized disclosure of administrative credentials. The affected devices include R6700v2 routers running firmware versions prior to 1.1.0.38 and R6800 routers running firmware versions prior to 1.1.0.38. This vulnerability is classified as CWE-522 (Insufficiently Protected Credentials) and could potentially allow attackers to gain administrative access to the affected devices.
Overview
The vulnerability (CVE-2017-18845) affects NETGEAR R6700v2 and R6800 router models with firmware versions prior to 1.1.0.38. The issue allows for the disclosure of administrative credentials, which could enable unauthorized users to gain administrative access to the affected routers. This vulnerability represents a significant security risk as it could lead to complete compromise of the router, potentially allowing attackers to modify network configurations, intercept network traffic, or use the router as a launching point for further attacks on the network.
Remediation
To address this vulnerability, users of affected NETGEAR router models should:
- Update the router firmware to version 1.1.0.38 or later immediately.
- To update the firmware:
- Access the router's web interface by typing its IP address in a web browser
- Log in with your administrator credentials
- Navigate to the Administration or Advanced section
- Select the Firmware Update option
- Download the latest firmware from NETGEAR's official website
- Upload the firmware through the router's web interface
- After updating, change the administrative password to a strong, unique password.
- Enable two-factor authentication if available.
- Disable remote management features if not required.
References
- NETGEAR Security Advisory for Admin Credential Disclosure (PSV-2017-2137): https://kb.netgear.com/000049014/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-Routers-PSV-2017-2137
- MITRE CWE-522 (Insufficiently Protected Credentials): https://cwe.mitre.org/data/definitions/522.html
- NETGEAR Product Support for R6700v2: https://www.netgear.com/support/product/R6700v2
- NETGEAR Product Support for R6800: https://www.netgear.com/support/product/R6800
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
