Turning off UPnP causes authentication errors RAX80

[CyberTri]

If you don't know what UPnP (universal plug n' play) is look it up. It's a notoriously poorly rated, insecure, feature which was implemented to make lazy manufacturers not have to fight routers when advertising ports inside of home networks.

Its garbage. So as a security engineer for over 15 years, I never use it. I have owned multiple Asus and Netgear routers and Cisco FWs for home use. Never use UPnP.

I don't want my video cameras (which are often made in China...no matter what manufacturers assembles them) being able to open ports to the internet which then get constantly scanned and attacked for weakness by Nmap (look it up) hackers on the web.

So, I haven't asked it for years. Not on my X6 (R8000) before my new RAX80. So, I was very surprised to find out that on some firmware (.58 & .61 for sure) I discovered that if you turn it off multiple devices (Galaxy phones, HP laptops, Alexas) will get "Authentication errors".

No...I'm not kidding. Try it yourself.

NETGEAR: This is entirely UNACCEPTABLE. Fix your crappy firmware so that I and others that understand what this is about don't have to leave UPnP enabled to use our devices. Also,.61 broke the capture option in your /debug.htm menu.

Really. $400 to be more vulnerable to attacks than ever before. FAIL!

[CyberTri]

Typo:

So, I haven't (used) it for years. 

[CyberTri]

Nmap -

https://en.m.wikipedia.org/wiki/Nmap

UPnP-

https://en.m.wikipedia.org/wiki/Universal_Plug_and_Play

[CyberTri]

Good discussion about how unsafe UPnP is. 

https://security.stackexchange.com/questions/118918/is-upnp-still-insecure/118951#118951

And this: 

https://medium.com/@DIFM_Solutions/the-road-to-hell-is-paved-with-good-intentions-disable-upnp-on-yo...

[Christian_R]

Hi CyberTri - Would you mind providing a screenshot when the 'Authentication Error" occurs.

~Christian 

[CyberTri]

Really? You need a screen shot of the words "Authentication error"?

It happens on every device. Alexa. Android.

Turn off your UPnP and screen shot it yourself.

[CyberTri]

I have a case open for this. Case #: 41574005

Im just warning other people who also know that UPnP is a crap feature and Netgear has botched the ability to disable it on a "state of the art" AX device they just released

[CyberTri]

[CyberTri]

Case #41574005

Bug confirmed:

Hi Dan, I was able to reproduce the issue in our lab and capture the debug logs as well. I will proceed on escalating this case to our engineering team ....... Regards, Eduard Expert ID: 8305 NETGEAR L2 Support Expert

[Christian_R]

Hi CyberTri - Thanks for posting an update on the thread. We look forward to further updates as you continue to work with our Support Team on debugging the issue. Feel free to reach out if I can be of any further assistance. 

~Christian 

[CyberTri]

Why is this still broken Netgear? My Alexas sometimes won't authenticate even with UPnP on (which I am forced to use due to this PROVEN bug)

[CyberTri]

Still not fixed as of Firmware Version 1.0.1.70. With UPnP off multiple devices have authentication errors. Alexa Show and Spot, Chromecast... especially seem affected.

[svan71]

Your concerned about privacy/security yet you use Alexa?

[kennyjimno]

The same exact problem here

[kennyjimno]

As a matter of fact .... i have it enabled right now and none all of the devices you have i have Samsung Note10 5g, multiple Alexa show devices Authentication Error.

[kennyjimno]

So I restart the Router and then the Nighthawk app now says that my Router is not compatible with the Nighthawk app?

[kennyjimno]

Correction the app says my Router is not supported

[CyberTri]

Helpful. Now let me do the same for you.

https://paranoid.com/products
https://www.techradar.com/how-to/how-to-stop-alexa-from-listening-to-you

Pretty cheap solution. Also:

https://www.techlicious.com/blog/amazon-alexa-recordings-how-to-delete/