NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Configuration Hijacked?
On my Orbi RBR50 Router (firmware version V2.3.1.44),
I noticed some strange sounding NVRAM configuration variables (use "nvram show" via the telnet interface):
hijack_config_time1=16:04:51 Dec 3...
gerd94706 wrote:
Can other owners please check if they've got the same, and post their responses?
Yes, my Orbi RBR50 v2.3.1.60 has these entries:
| hijack_config_status=5 |
| hijack_config_time1=13:01:25 Jan 29, 2019 |
| hijack_config_time2=02:35:42 Mar 06, 2019 |
| hijack_config_time5=02:35:01 Mar 06, 2019 |
| hijack_config_time6=02:35:16 Mar 06, 2019 |
| hijack_config_time7=02:35:20 Mar 06, 2019 |
| hijack_config_time8=02:36:24 Mar 06, 2019 |
| hijack_config_time9=02:36:25 Mar 06, 2019 |
| hijack_language=0 |
| hijack_passwd=355153064881591 |
| hijack_process=3 |
| hijack_refresh_counter=0 |
I'm also in v60, but didn't see anything in the logs. If your Orbi is in Router mode and telnet is left enabled, that's asking for trouble. FWIW, my Orbi is in AP mode.
It's nothing to be concern about. From the peek into the firmware, it's Orbi Router who is hijacking its Satellite's config to sync up...
Here is an example:
root@RBR50:/# config get hijack_config_status
5
var config_status = "<% cfg_get("hijack_config_status") %>"; ... switch(config_status) { case "1": content_frame.setAttribute("src", "BRS_orbi_satellite_start.html"); return; case "2": content_frame.setAttribute("src", "BRS_wlan_security.html"); return; case "3": content_frame.setAttribute("src", "BRS_wlan_plsWait.html"); return; case "4": content_frame.setAttribute("src", "BRS_orbi_complete.html"); return; case "5": content_frame.setAttribute("src", "BRS_check_manulConfig.html"); default: break; }