Can't find latest CBR40 Firmware as Described in Security Bulletin

GWild · ‎2021-02-10

Security bullitens list this info:

NETGEAR has released fixes or hotfixes for an unauthenticated command injection security vulnerability on the following product models:

CBR40, running firmware versions prior to 2.6.1.38

But on the download page only this is listed:

Firmware and Software Downloads

Current Versions
CBR40 Firmware Version 2.5.0.14

Where do I go to find the latest release?

Even weirder: the RBS20 firmware (2.6.2.104) they have that is supposed to fix this hole is not compatible with my RBS20. Too funny.

Top Support Articles

EU Declarations of Conformity
RBR20 / RBS20 Firmware Version 2.6.2.104

Blanca_O · ‎2021-02-17

Hi @GWild

Thanks for bringing this to our attention.

The KB Article has been updated with its correct firmware version

https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerabili...

The CBR40 FW that addresses this PSV is v2.5.0.14. and for RBR20/RBS20 it’s v2.6.1.38.

@FURRYe38, thanks for looping me in!

Regards,
Blanca
Community Team

View solution in original post

FURRYe38 · ‎2021-02-10

Where do you find this information?

Nothing posted yet on NG download site:

https://www.netgear.com/support/product/CBK40.aspx#download

Something to contact NG support about and see.

GWild · ‎2021-02-11

The RBS20 firmware link that my slave says is incompatible is at:

https://www.netgear.com/support/product/RBS20.aspx#download

Top Support Articles

FURRYe38 · ‎2021-02-11

You need to use what is avialable from the CBK site:

https://www.netgear.com/support/product/CBK40.aspx#download

Untill NG makes it compatible with the CBR40.

GWild · ‎2021-02-11

What this is telling me is that the CBK40/CBR40 have not received updates, and that this vulnerability remains for the CBK40/CBR40 products. Not exactly comforting to know there is a known 8.5+ ranked hack that your gear is subject to.

As for contacting support, what you probably already know, they do not talk with owners after 90 days from purchase unless you have paid for an expensive support plan.