What's the word on Zuorat?

[paulja]

Who is affected? How can we check? How do we fix?

[ChristineT · Accepted solution]

Hello NETGEAR Community,

We’re unaware of any specific NETGEAR devices impacted because details are scarce on how this purported nation-state sponsored malware operates, but if you have reason to believe you’re impacted, we recommend doing a factory reset and installing the latest firmware as described at https://kb.netgear.com/23442/How-do-I-update-the-firmware-on-my-NETGEAR-router-with-a-web-browser.

Thank you,

Christine

[FURRYe38]

NG is looking into this as of last Tuesday:

https://arstechnica.com/information-technology/2022/06/a-wide-range-of-routers-are-under-attack-by-n...

If you are a NETGEAR customer with a security-related support concern, you can contact NETGEAR customer support at techsupport.security@netgear.com.
For all other issues, visit http://www.netgear.com/about/security/

[ChristineT · Accepted solution]

Hello NETGEAR Community,

We’re unaware of any specific NETGEAR devices impacted because details are scarce on how this purported nation-state sponsored malware operates, but if you have reason to believe you’re impacted, we recommend doing a factory reset and installing the latest firmware as described at https://kb.netgear.com/23442/How-do-I-update-the-firmware-on-my-NETGEAR-router-with-a-web-browser.

Thank you,

Christine

[paulja]

Thanks for the response. It is a little worrying because the solution you give (factory reset) although not stopping the infection or re-infection, is the temp solution for a compromised system.

The news report clearly state Netgear (amongst others) could be be affected- https://threatpost.com/zuorat-soho-routers/180113/

[FURRYe38]

The article said "could" be. Doesn't mean everything. 

Also the article said that a factory reset does clear the problem out "IF" it should be found on a router. 

I recommend that users create a current backup configuration to file for safe keeping. Should something be found or a factory reset is needed, will save you time on getting back online.