Orbi WiFi 7 RBE973
Reply

Re: Web GUI Password Recovery and Exposure Security Vulnerability

hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability

Thak You michaelkenward for your constructive suggestion 🙂

 

Looks like I will have to do that when I have the time.

 

My basic problem is that when I go to the Advanced Menu page for changing passwords there is no checkmark block to check to "Enable PW Recovery"

 

The IP address shown in dos after following the preliminary instructions is not "my ISP IP", it is my router's IP I assume.

 

But when I enter either IP address in the address bar it brings me to the same GUI with no box to check "To Enable PW Recovery"

 

I can see the unchecked remote box on another page.

 

hawkeye

Message 26 of 49
TheEther
Guru

Re: Web GUI Password Recovery and Exposure Security Vulnerability

hawki, what is the model of your router?

Message 27 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability


@TheEther wrote:

hawki, what is the model of your router?



AC 1750 WiFi Cable Modem Router (C6300)

 

Using with an AC1200 High Gain WiFi USB Adapter

 

I have the latest version of Genie Installed, but Genie is unable to make my WiFi connection, I have to connect using the push buttons on the USB adapter and Router. Perhaps because I try to have Genie make the connection after the connection is already made. It is able to track the interference in wi fi analytics, but the signal strength meter says not connected. Weird.

 

Genie appears to perform all other functions.

 

According to Genie I have the latest firmware installed.

 

Thank you for your time.

 

hawkeye

Message 28 of 49
TheEther
Guru

Re: Web GUI Password Recovery and Exposure Security Vulnerability

hawki, the Netgear security bulletin says that the C6300 with firmware version v2.01.14 is affected.  Are you running that version?

 

Are you using the desktop Genie to change passwords?

 

I could be mistaken but the recovery password option is available directly through the router's web portal (i.e. by logging through http://routerlogin.net or your router's IP address).  You will find the recovery option in ADVANCED > Administration > Set Password.

Message 29 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability


@TheEther wrote:

hawki, the Netgear security bulletin says that the C6300 with firmware version v2.01.14 is affected.  Are you running that version?

 

Are you using the desktop Genie to change passwords?

 

I could be mistaken but the recovery password option is available directly through the router's web portal (i.e. by logging through http://routerlogin.net or your router's IP address).  You will find the recovery option in ADVANCED > Administration > Set Password.


I did attempt to enable "Recover Password " via the router's IP address AND through my ISP's IP assigned agress by entering them into the address bar of my browser. Both gave me the same result.

 

Do you determine the firmware version through Genie? I just uninstalled my Genie and will reinstall.

Message 30 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability

oOps - firmware version is V1.02.20

I recently installed a program that knocked out my Netgear Connectiom. Reinstalled with the Net Gear Set Up disc. Is there a way to manually update the firmware?

 

I usually get a pop up respecting firmware upgrades.

Message 31 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability


@TheEther wrote:

hawki, the Netgear security bulletin says that the C6300 with firmware version v2.01.14 is affected.  Are you running that version?

 

Are you using the desktop Genie to change passwords?

 

I could be mistaken but the recovery password option is available directly through the router's web portal (i.e. by logging through http://routerlogin.net or your router's IP address).  You will find the recovery option in ADVANCED > Administration > Set Password.


WTF? I bought my NetGear WiFi Router Cable Gateway a year ago and there are no firmware upgrades available on Th eNetgear Support site. Is it no longer supported?

Message 32 of 49
TheEther
Guru

Re: Web GUI Password Recovery and Exposure Security Vulnerability

hawki, it's not clear to me what you are seeing when you attempt to log into the C6300.  It should look like this (complements of setuprouter.com):

gui

 

 Then you should click on the Advanced tab at the top, then Administration on the side and finally Set Password, similar to this:

advanced

 

As far as firmware upgrades is concerned, the C6300 is a cable router modem.  It is frequently the case for such devices that firmware upgrades are available only through your ISP.  If the C6300 is not officially supported by your ISP, then you are outta luck.  Smiley Sad

Message 33 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability

Th


@TheEther wrote:

hawki, it's not clear to me what you are seeing when you attempt to log into the C6300.  It should look like this (complements of setuprouter.com):

gui

 

 Then you should click on the Advanced tab at the top, then Administration on the side and finally Set Password, similar to this:

advanced

 

As far as firmware upgrades is concerned, the C6300 is a cable router modem.  It is frequently the case for such devices that firmware upgrades are available only through your ISP.  If the C6300 is not officially supported by your ISP, then you are outta luck.  Smiley Sad

 

That is what I see. When I go to the set password page there is NO box to check to "Enable PW Recovery when I go to the set password page. I will check with my ISP. Cox has two categories of compatible modems: 1) Cox Preferred Devices; 2) Additional Cox Recommended DOCSIS 3.0 Devices. My C6300 falls under category 2. My modem works fine and delivers more than my guaranteed 100Mbps - It gives me 130Mbps

 

I will check with Cox, but I doubt they will have a firmware update. In the past all my firmware updates have been downloaded from Netgear after a pop-up appears asking me if I want the upgrade. But firmware squirmware - why do I not have the box to enable PW recovery? Is that something new?

 

Windows also searched The Net for a firmware update and said I had the latest as does my Genie.

 

Weird - so now I don't know if I have the vulnerability or not.

 

Thanks again for your taking the time to try to help 🙂

 

hawkeye

 

Message 34 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability

TheEther

 

You are correctl. According to Netgear:"Note: There is no option in the web interface to upgrade the firmware manually. Firmware upgrades are pushed down by the ISP."
 

The security advisory lists  Cable Gateway Model and Firmware Version: C6300 v2.01.14  as being subject to the vulnerability. V 2.01.14 is only available to Comcast and Time Warner customers to fix a connectrivity issue.

 

Am I correct, therefore, in assuming that the security advisory does not apply to my C6300 with its version 1.02.20 firmware?

Message 35 of 49
TheEther
Guru

Re: Web GUI Password Recovery and Exposure Security Vulnerability

That's what it sounds like.  Given that you cannot act on their recommendation to enable password recovery, you should just make sure that remote management is turned off.  You should be relatively safe.

Message 36 of 49
ElaineM
NETGEAR Employee Retired

Re: Web GUI Password Recovery and Exposure Security Vulnerability

For clarification, C6300 and other Cable Gateways does not have Password Recovery feature.

Just ensure that Remote Management is disabled.

Message 37 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability


@ElaineM wrote:

For clarification, C6300 and other Cable Gateways does not have Password Recovery feature.

Just ensure that Remote Management is disabled.


Thank You ElaineM 🙂

 

Perhaps you could inform the Manager of the team responsible for writing Security Advisories to be more accurate, precise, and informed so that in the future Netgear Equipment owners will not have to waste frustrating hours of their valuable time apparently chasing ghosts.

 

Also, you should advise that Team that copies of all Security Advisories must be be sent to ALL personnel of the Netgear Telephone Support Tech Team so they do not give out misinformation that a legitimate advisory email is a scam that should be ignored.

 

I enjoy my Netgear Equipment. But Netgear's Support Team needs imrovement in its accuracy and procedures and promptness in informing Netgear owners of vulnerabilites that were posted on the Netgear site nearly two months before myself and several others received the info.

 

I rate Netgear Equipment A. I rate Netgear support as a near total fail.

 

I sincerely appreciate your help as well as the time TheEther and  michaelkenward invested in trying to help me with what may have been a needless exercise in futility.

 

The sad fact is that , despite several attempts at clarification, for several reasons I still do not have 100% confidence that my Netgear A6300 is not vulnerable to the issue the security advisory attempted to address. This is due mainly to the inprecise/vague wording of the Security Advisory. If an A6300 with not the latest firmware is not subject to the vulnerability, the advisory should have made that clear. I plan on replacing my A6300 ASAP. Netgear should do the same with its security advisory and Tech Support Teams.

 

hawkeye

Message 38 of 49
glassdreams
Aspirant

Re: Web GUI Password Recovery and Exposure Security Vulnerability

Does anyone have any idea why I can't log into the www.routerlogin.net or www.routerlogin.com site to be able to actually to the recommended "patch"?

Message 39 of 49
ElaineM
NETGEAR Employee Retired

Re: Web GUI Password Recovery and Exposure Security Vulnerability

@hawki Yes, I have brought it up already to the management team.

All our support personnel are copied to these kinds of information and the team is investigating as to what had transpired in that event.

We highly value your feedback and rest assured that NETGEAR will continue to improve its products and services.

Thank you for being a NETGEAR loyal customer.

 

@glassdreams You may want to see this article for more information.

Message 40 of 49
CarolO
Aspirant

Re: Web GUI Password Recovery and Exposure Security Vulnerability

Ok, I am no way as savvy as you people so please help me out.  I got the email too.  About 3 weeks ago I learned my data allottment was used in one night, hacked and stolen by some yahoo who downloaded porn from directv.  I was on the phone for 3 hours with tech support from excede internet, netgear and directv, none of which would take responsibility or even help me.  So, I had to limp around on dialup speed for a month.  Now I get this email and the directions might as well be in another language.  I tried to do what they suggested, but it doesn't work.  Here's my question.   I am connected tyo the internet via satellite because I live in the sticks.  Do I have to have the router?  My understanding was that the sat internet cmes thru the exede router and the netgear router only boosted the wifi signal.  Sorry to be so stupid at this, but it's completely confusing to me!

 

Message 41 of 49
pookie525
Aspirant

Re: Web GUI Password Recovery and Exposure Security Vulnerability

CarolO,

 

I have never had satellite internet but I believe that the device that you are speaking of that you get your internet from is the modem.  The router from Netgear enables you to receive wifi throughout your home.  I am fairly certain that you would need the router unless your computer is directly plugged into the other device that you have. 

Message 42 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability

Hi CarolO 🙂

 

I am very sorry to hear of your dreadful experience with an unsecure connection and Netgear Support among others. If Netgear Support told you he/she would not help you, that is outrageous. If on the otherhand,  you were told they could not help you, that would be a different story.

 

Are you using default passwords?

 

If your excede modem has a router I don't know why you would need a Netgear Router, unless the excede router was not powerful enough for your home.

 

http://www.exede.com/wifi-modem/

 

I do not know enough to help you but there are others on this Forum who probably do.

 

With my issue TheEther and michaelkenward  were particulalrly helpful and gave up a lot of their time to try to help me.

 

I suspect they, or someone similalrly qualified will see your post and offer assistance.

 

Does Direct TV or excede have a forum?

 

Hopefully It Was All Just  a Bad Dream and it's time to wake up.

 

The Netgear Genie app will tell you what is connected to your network and if your channel is being also being used by someone else. Not sure if that would be of much help.

 

There are various ways to connect your network, some more secure than others. But again I don't know enough to help you.

Message 43 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability

I see
 
I thought you were talking about a wireless gateway router (modem and router)
 
But again I am relatively clueless how to prevent the hijacking of your network and or bandwidth.
 
Apparently there is scum even in the "sticks"
 
Sorry
Message 44 of 49
doraemon
Prodigy

Re: Web GUI Password Recovery and Exposure Security Vulnerability

You may have to clarify more on your network setup.

In general, you will have a modem from your ISP and then that modem is connected to a router.

Having said that you received the email, which Netgear device model number you? 

The model number can be seen on the bottom of the unit in a tiny print that says MODEL NO. 

Message 45 of 49
TheEther
Guru

Re: Web GUI Password Recovery and Exposure Security Vulnerability

CarolO,

 

hawki is on the right track.  The key is knowing whether you have a Excede modem or a Excede Wi-Fi Router.  According to Excede's website, their Wi-Fi Router has been available only since November 2015.  If your service is older than that, then you probably only have a modem.  One sign that the Excede is a Wi-Fi Router is that it has 4 or more Ethernet Ports.  A modem will have only one Ethernet port.  Can you take a look?

 

If you have a Modem, then you will need to keep your Netgear router.  If you have a Wi-Fi Router, then your Netgear is optional. 

 

Message 46 of 49
CarolO
Aspirant

Re: Web GUI Password Recovery and Exposure Security Vulnerability

I have the excede modem.  The router is the netgear 6250 smart wifi.  I think I may have figured this out.  If the email purportedly from netgear was a hoax then no problem.  

Message 47 of 49
hawki
Apprentice

Re: Web GUI Password Recovery and Exposure Security Vulnerability

The eMail WAS NOT a hoax. A Netgear TelephoneTech Support Team Memeber was uninformed and said it was a hoax/scam.

Message 48 of 49
pookie525
Aspirant

Re: Web GUI Password Recovery and Exposure Security Vulnerability

The email was not a hoax.  Someone just didn't know what they were talking about at customer service (or couldn't understand the caller to begin with).  It was confirmed on here by mods and it also on the Netgear page if you go under support for your particular model of router. 

Message 49 of 49
Top Contributors
Discussion stats
  • 48 replies
  • 7620 views
  • 13 kudos
  • 10 in conversation
Announcements

Orbi WiFi 7