Trying to solve Nighthawk D7000 vulnerability

[Melbguy1]

Hi folks, I own a Nighthawk D7000 wifi/router (AC1900) which I bought approximately 1 year ago. The issue is my ESET Internet Security keeps picking up the following vulnerability when I run a scan of attached network devices. My sotware then suggests checking for new firmware. I have updated the firmware before and it doesn't solve the problem. The router's security settings are set to default - WPA2-PSK(AES) and the firmware version is - V1.0.1.54_1.0.1 

I get the following message every time I run the scan -

"Your router may contain known vulnerabilities that could make it easy to attack and exploit."

- Vulnerability name: EDB-31617A

- Vulnerability type: Bad access rights

I guess my first question would be, Is this a critical vulnerability? Are Netgear working on a firmware update to resolve the vulnerability? I'm obviously not keen to sell a product that's just over 12 months old to fix an in-built security hole. Thanks in advance for your input.

[antinode · Accepted solution]

> "Your router may contain known vulnerabilities that could make it easy
> to attack and exploit."
> - Vulnerability name: EDB-31617[,]A
> - Vulnerability type: Bad access rights

   How valuable is a vague warning about what "Your router may contain"?
I'd be more interested in which specific known vulnerabilities my router
actually _does_ contain.

   My quick Web search found this for EDB-31617:

      https://www.exploit-db.com/exploits/31617/

      Published: 2014-02-12

   One example:

      5.  Gearguy/Geardog Telnet Backdoor

      [...] provides a shell without a password required. [...]

Around here (D7000, V1.0.1.54_1.0.1), such Telnet access (now) requires
the "admin" password.

   So, at least one of the (ten) "known vulnerabilities" described in
that document seems to have been resolved in this case.  Obviously,
that says little about some of the other items in that document, but
that's only one more reason to complain about the vagueness of the
warning from "my ESET Internet Security".  For all we know, it may
issue this warning whenever it sees a Netgear router.

   Of course, Netgear firmware Release Notes which offer such specifics
as "Improved security" and "Security Enhancement" do little to inform or
reassure users.

   Summary: It's a uselessly vague warning about a set problems which
were reported about one specific router+firmware combination from three
years ago, and may or may not apply to yours (and mine).

   How much better that should make you feel is not immediately clear.

[antinode · Accepted solution]

> "Your router may contain known vulnerabilities that could make it easy
> to attack and exploit."
> - Vulnerability name: EDB-31617[,]A
> - Vulnerability type: Bad access rights

   How valuable is a vague warning about what "Your router may contain"?
I'd be more interested in which specific known vulnerabilities my router
actually _does_ contain.

   My quick Web search found this for EDB-31617:

      https://www.exploit-db.com/exploits/31617/

      Published: 2014-02-12

   One example:

      5.  Gearguy/Geardog Telnet Backdoor

      [...] provides a shell without a password required. [...]

Around here (D7000, V1.0.1.54_1.0.1), such Telnet access (now) requires
the "admin" password.

   So, at least one of the (ten) "known vulnerabilities" described in
that document seems to have been resolved in this case.  Obviously,
that says little about some of the other items in that document, but
that's only one more reason to complain about the vagueness of the
warning from "my ESET Internet Security".  For all we know, it may
issue this warning whenever it sees a Netgear router.

   Of course, Netgear firmware Release Notes which offer such specifics
as "Improved security" and "Security Enhancement" do little to inform or
reassure users.

   Summary: It's a uselessly vague warning about a set problems which
were reported about one specific router+firmware combination from three
years ago, and may or may not apply to yours (and mine).

   How much better that should make you feel is not immediately clear.

[Melbguy1]

Hi Antinode,

Thanks very much for your helpful reply and insight into the likely origin of that reported vulnerability, which as you said would appear to have been substantially resolved long ago. Given the vagueness and broad scope of the security warning from ESET, I'll just ignore that specific warning when it appears in future. I just updated to the latest firmware version (v1.0.1.60_1.0.1) which contained a security update, so I should be covered.

Cheers,

Melbguy.