This topic has been marked solved and closed to new posts due to inactivity. We hope you'll join the conversation by posting to an open topic or starting a new one.
If a web page appears (which is not an error): you’re vulnerable. In my case, the page contains a text that starts with: Linux R7000 2.6.36.4brcmarm+ (...).
Re: Two leading Netgear routers are vulnerable to a severe security flaw
StaticFX,
This is the link for the R7000 specific version of the firmware. I have been running this for a long time now with no problems. It makes me like my Netgear router again...
Re: Two leading Netgear routers are vulnerable to a severe security flaw
According to all threat assessment sources, Netgear was made aware of the vulnerability in August but chose to ignore the cyber security community which is why the issue was never resolved any sooner. We should hope they will act more promptly in the future. Nighthawk routers aren't cheap - they are future-proof investments.
NETGEAR is aware of the security issue #582384 affecting R6400, R7000, R8000 routers. Stay updated here: http://kb.netgear.com/000036386/CVE-2016-582384 We're working hard for a fix and will update the security ticket above soon.
Ok am I dense? Why is this green checked as solved? Acknowledging there is a problem is not a solution in itself. Kinda misleading doncha think?
According to all threat assessment sources, Netgear was made aware of the vulnerability in August but chose to ignore the cyber security community which is why the issue was never resolved any sooner. We should hope they will act more promptly in the future. Nighthawk routers aren't cheap - they are future-proof investments.
I've really gotta be cynical about this response lag. On a post on another thread I said Netgear needs to be more proactive than reactive as in auditing its own code and revamping firmware deployment model such as making it more modular so people could apply package and kernel updates as in desktop applications of Linux. Oh and do something about the user interface. Ancient kernels and applications are bad enough but the UI is apparently also a weak link in the chain. And so much for the keeping remote manafement off "panacea" since a bad ad might exploit your browser to topple the router from inside the network. Nice.
But if there was that long of a response lag between when Acew0rm tried notifying Netgear and the vulnerability made public I don't think the term "reactive" is appropriate. Head in sand might be better. It's about PR and pleasing ....wait for it... investors.
The saddest part is that those of us who know about the problem(s) with Netfear and other router vendors are probably a very small portion of endusers. Therefore very little free market accountabilty.
And I used to mock Microsoft. Well I still do 😊
At least there are alternatives such as building your own Ubuntu router box, open source firmwares, or something such as a pfsense box. The latter can be had as turnkey without too much fuss.
Is X-10 R9000 also affected? Can someone please check?
It is a new product, so ZDNet might not have tested it.
What is unique to the product lines affected versus other Netgear routers? How can we be sure the other sorts of routers are safe? I could understand that NetUSB would be limited to routers with that feature but why this one having relevance to only a handful of Netgear routers?
NETGEAR is aware of the security issue #582384 affecting R6400, R7000, R8000 routers. Stay updated here: http://kb.netgear.com/000036386/CVE-2016-582384 We're working hard for a fix and will update the security ticket above soon.
Ok am I dense? Why is this green checked as solved? Acknowledging there is a problem is not a solution in itself. Kinda misleading doncha think?
I saw that too. No idea, because it is not resolved. Maybe they are worried that people will not be buying these routers for Xmas?
Re: Two leading Netgear routers are vulnerable to a severe security flaw
I think that was probably marked as the solution by a colleague so that users could quickly find the advisory to follow to keep updated on the issue.
As our investigation continues we will have further updates to our security advisory. Thank you for your patience.
We have an email dedicated for security concerns e.g. reporting security issues. It's mentioned in the security advisory and also on the Security Advisory section of our website: http://www.netgear.com/about/security/
I think that was probably marked as the solution by a colleague so that users could quickly find the advisory to follow to keep updated on the issue.
As our investigation continues we will have further updates to our security advisory. Thank you for your patience.
We have an email dedicated for security concerns e.g. reporting security issues. It's mentioned in the security advisory and also on the Security Advisory section of our website: http://www.netgear.com/about/security/
So you admit not a solution? And I am not sure what to think about announcement of the dedicated security email. I hope it isn't a way to deflect those voicing security concerns from the spotlight on these public forums. Those concerns need to remain public. But if it is to take security concerns seriously (PR blah blah...puppies and kittens) why did this vulnerability not get addressed months ago? That's a PR loss and corporate responsibility epic fail as I see it.
Re: Two leading Netgear routers are vulnerable to a severe security flaw
Thank you...It looks like I am affected. However, I follow the steps to kill the vulnerbility but it doesn't seem to work. After I follow the steps I recheck and I am still getting "Linixu r8500..."
Any ideas? I have tried the router login and also my routers IP address....Maybe it's just time I move on from Netgear...
*edit - I believe I got it working. I get a page cannot be displated when testing. Still my confidence in Netgear is at an all time low and am thinking I will go with a different company.
Re: Two leading Netgear routers are vulnerable to a severe security flaw
I tested my D6400 and it is also vulnerable, your security notice only mentions the R6400 so please dont forget the DSL versions of the same routers too.
I tested my D6400 and it is also vulnerable, your security notice only mentions the R6400 so please dont forget the DSL versions of the same routers too.
Re: Two leading Netgear routers are vulnerable to a severe security flaw
In general beta firmware can be hit or miss. Sometimes it is just fine, sometimes it introduces new problems. (I've seen that in beta tests of new hardware.)
Firmware rarely, if ever, kills a device so long as you let it complete the process. That's why some people advise against doing regular updates over wifi, which probably won't apply in this case.
Before you flash, you should retrieve and file away a copy of the current firmware. You can then flash back to that if you have problems.
It is often also advisable to reset your hardware to the factory settings after the firmware flash. That isn't always needed. (Perhaps someone can advise if the changes with these updates requires a reset.)
It is up to you to decide to use it. If you are seriously worried about this vulnerability, then do it. If not, hang on until a few other people have tried it.
Re: Two leading Netgear routers are vulnerable to a severe security flaw
It's up to you.
You can try the beta if you like or you can wait. In the unlikely event you have issues as a last resort you should be able to put the non-beta firmware back on and do a factory reset.
Beta firmware will have undergone some basic testing but not the full QA cycle.
