NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
FURRYe38
Dec 01, 2022Guru - Experienced User
New - RBR850 / RBS850 Firmware Version 4.6.14.3 Released
Security Fixes: 12/01/2022
Addresses security vulnerabilities.
For more information about security vulnerabilities, visit https://www.netgear.com/about/security.
Bug Fixes:
Moves th...
FURRYe38
Jan 04, 2023Guru - Experienced User
Ok so you didn't mention updating the RBS. The RBS need to be updated first thing BEFORE The RBR. Use the RBS web page to update the FW on the RBS. Don't use the RBRs web page.
Then update the RBR lastly...
What you might want to do is set the RBR back to router mode, disconnected from the main host router. Factory reset the RBR using the ERASE funtion under Admin/Backup. Setup the RBR and RBS again with out the RBR being connected to the host router. Then update the FW on the RBS first and once you have the RBS FW file sent to each RBS, then manually re-load the RBR FW. Be sure you use the RBS FW file for the RBS and the RBR FW file for the RBR.
If you can get the FW re-loaded and updated, power OFF the RBR and RBS for 1 minute. Then back ON with the RBR then RBS.
Clear out all browser caches. Check for RBR and RBS web page access. Should be normal here. If it does, configure AP mode and set a static IP address on the RBR for something out side of the host routers default DHCP IP address pool. I use ###.###.#.85 on my RBR when it's in AP mode.
kotfu
Jan 04, 2023Guide
re RBS firmware updates: when I originally did the firmware upgrade, I did the RBS units one at a time, using their own web interface. After the first RBS has the new firmware and had restared and synced with the RBR, I went to the next RBS and repeated the procedure. After all RBS firmware was upgrade, I did the RBR firmware upgrade for the first time.
I followed the procedure you suggested:
- disconnect my RBR from my wired network and set it to router mode
- factory reset using the software tool in Admin/Backup
- configure RBR and RBS from scratch while all disconnected from my wired network
- I was successfully able to login to the web interface of the RBR using https://orbilogin.net
- reapplied the 4.6.14.3 firmware update to the RBR
- still can log in using https://orbilogin.net
- change configuration of RBR to access point mode using a different known unused static IP address (10.10.10.251)
- unplug power to RBR. While it sits for 1 minute, I connect RBR to my wired ethernet network using a cable
- plug power in to RBR and wait for it to boot
- verify I can ping the RBR new IP address 10.10.10.251
- update my internal DNS to point ap1.example.com to 10.10.10.251
- try to load https://ap1.example.com, get HTTP 500 Internal Server Error
- try to load https://10.10.10.251, which works fine.
Now I'm pissed off, and I'm determined to track down this problem. First I unplug power to all by RBS satellites and leave them unplugged to remove complexity in the target configuration. I disconnect the RBR from my wired network and do a factory reset. Reconfigure it from scratch using the procedure outlined above, same result.
Then I downgrade the firmware on the RBR to 4.6.9.11, do a factory reset, and set it to AP mode with a static IP 10.10.10.251. Everything works fine, no HTTP 500 Internal Server Error. So I do another factory reset, and configure AP mode with a dynamic IP instead of a static one. It works fine that way too. My hypothesis is now that it's a problem with the firmware 4.6.14.3. So I install 4.6.14.3 on the RBR, configure AP mode with a dynamic IP address, and the HTTP 500 Internal Server Error is back. After more experimentation and exploration with more sophisticated command line tools (nmap, dig, curl), here's what I know.
The error is observed:
- using firmware 4.6.14.3 on an RBR850, but not using firmware 4.6.9.11
- configured in AP mode (doesn't matter whether you use a static IP or dynamic IP)
- access web interface using a hostname, not an IP address (obvs in AP mode the hostname has to be provided by something besides the RBR because in AP mode the RBR DNS server is off)
- when accessing either http://ap1.example.com or https://ap1.example.com ie the error occurs independent of whether the web connection is encrypted with TLS
- before the authentication prompt, ie the HTTP 500 Internal Server Error occurs before the RBR prompts for the administration credentials
- regardless of browser used. I have replicated the error using using Safari, Chrome, Firefox, and curl.
- whether there are RBS satellites connected or not
The error is not observed:
- in the Orbi app for iOS. The app seems to work fine in all configurations and firmware levels.
There are two workarounds:
1. access the web admin tools using the IP address, ie https://10.10.10.251 (or whatever the IP address you've given to your RBR, either statically or dynamically when enabling AP mode)
2. downgrade the firmware to 4.6.9.11.
My guess is that firmware version 4.6.14.3 for the RBR introduced an error in the web server configuration.
Thanks for your suggestions FURRYe38 , but unless you can whisper in someone's ear and have them create a new version of the firmware, I don't think there is any way to fix this problem.