Re: unauthenticated access to devshell debugging URL

alarmologist · ‎2020-04-29

Hi,

I have a question about the issue that allowed unauthenticated access to devshell in the web interface. It was fixed back in 2017.
Do the devshell URLs allow commands to be run on the switches, or does it just leak information?

I have XS712T, M7100-24X and M4100 switches that are affected. It appears to be the only security issue that affects some of my switches and I do not want to upgrade my firmware for anything except major security flaws.

For XS712T it was fixed in 6.1.0.36

For M7100-24X it was fixed in 11.0.0.31

For M4100 it was fixed in 10.0.2.26

Thanks

msi · ‎2020-04-30

Since I'm not from Netgear I can't help you with the details about the fixed security issue you were asking. However I've had the M4100 in production and have since then handed them to local non-profits where some are still in use today.

Even though the M4100's had pretty stable firmware over the time (retired the last in mid 2019), there have been numerous bugfix releases since 2017 with quite some stability improvements (like randomly losing its config, luckily it never occured to me) and and also security-wise (disabling ciphers deemed outdated by modern standards etc.)

All mentioned switches are not that recent, so most of their known issues have been ironed out by now. The latest firmware for the M4100 and M7100 date back from october 2019, the latest for your XS712T is even from april 2017. That's definitely not bleeding edge anymore.

I'd upgrade them to their latest firmware at this point if I were you. IMHO it's not worth the hassle to hold out onto an old version which is missing fixed stability issues for these models.

I'm more prudent on things like the M4300 which get more developers attention and update the firmware after letting it seed (test-deploy) to less important locations. - The latest M4300 firmware is from end of april 2020.

If issues pop up (be it in testbed or i.e. if things pop up in the forums), I can skip this release and roll back. Otherwise this firmware gets installed to main locations during the next planned maintenane. This way I can keep the changes small and identify if regressions have sneaked in between releases instead of making a big leap of faith during updates.