Cannot perform Firmware upgrade for WN3000RPv3

[skeefiez11]

Hello. I ran a network scan using my Internet Security Suite SW and it detected the following:

 UPNP: Service is vulnerable to attacks from within your network.

Risks: Attackers can execute their own code on this device and completely control this device's system

Type: UPNP

Port: 4915x.... (not putting the port here for security purposes..)

Vulnerability ID: CVE-2012-5958

It recommended to update the extender's firmware.

So I logged into the extender via the netgear website () and it said I should update the FW from 1.0.2.50 to 1.0.2.70.  I proceeded to do that and it seemed to go through the process of downloading to my extender then was doing the "reboot" of the extender. It went to 100% then I next received the following page/message:

You are not connected to your extender's WiFi network.

If your router and extender use the same WiFi network name (SSID), follow these instructions:

Note: These instructions apply only to the following extenders:

• ▪Nighthawk X6S AC3000 Tri-Band WiFi Mesh Extender Model EX8000
• ▪Nighthawk X6 AC2200 Tri-Band WiFi Mesh Extender Model EX7700
• ▪Nighthawk X4S AC2200 Tri-Band WiFi Mesh Extender Model EX7500
• ▪Nighthawk X4 AC2200 Dual-Band WiFi Mesh Extender Model EX7300
• ▪AC1900 Dual-Band WiFi Mesh Extender Model EX6400

To log in to your extender, enter one of the following URLs in your web browser depending on your device:

• ▪Windows: http://mywifiext
• ▪Mac OS X or iOS:http://mywifiext.local
• ▪Android: http://<extender's IP address>
• For more information, visit https://kb.netgear.com/000044735.

Note: To find your extender's IP address, log in to your router and look for a list of devices connected to your router. The extender's IP address displays in the list. For more information, see your router's user manual.

If your router and extender use different WiFi network names (SSIDs), make sure that your device is connected to your extender's network.

To log in to your extender, enter mywifiext.net in your web browser.

For more information, visit http://kb.netgear.com/app/answers/detail/a_id/29746.

I cannot seem to get this to work. My devices are still connected to this extender so what is the problem? I tried this several times already and all lights on the extender are "green".  Please advise why this does not seem to be working? Another strange thing is when I logged again into the extender it shows this as a current "status":

• Hardware Version: WN3000RPv3
• Firmware Version: V1.0.2.70  <---0

Connection to Existing Network (2.4GHz)
Signal Strength:	144Mbps
Name (SSID):	xxxxxxxxx
Channel:	6
Connection Status:	Connected
Extender WiFi Status (2.4GHz)
Name (SSID):	zzzzzzzzz
Channel:	6
Region:	North America
Wireless mode:	Up to 145Mbps
Wireless AP:	ON
Broadcast Name:	ON
Wi-Fi Protected Setup:	Configured

so what is the deal and is this really updated or not and why the above error message?

Thank you. 

[schumaku]

Well, at the moment the firmware is uploaded the Wireless Extender does reboot, what does take a while. Your computer did most likely connect to another access point, extender, or your router. the reboot does take some time, depending on the 5 GHz channels some checks for radar interference have to be done, what does add another minute or two. 

The Web page you see is not an error message, much more it's a Web site on the Internet which does become visible of there is no Wireless Extender in the data path, and the mywifiext.net/.com is not captured by the Extender - because your computer is connected to a different wireless network.

[StephenB]

---

@skeefiez11 wrote:

Type: UPNP

Port: 4915x.... (not putting the port here for security purposes..)

Vulnerability ID: CVE-2012-5958

---

The port is just a private port (49162-65535) that your router has opened to the internet.  If someone knows your full IP address it would be useful, but not by itself.

At the end of the day it's your router that opens uPNP ports, not the extender.  So perhaps rescan.

[skeefiez11]

Hi Thanks.. so does this mean it really did upgrade to 1.0.2.70?

• Hardware Version: WN3000RPv3
• Firmware Version: V1.0.2.70

Connection to Existing Network (2.4GHz)
Signal Strength:	144Mbps
Name (SSID):	xxx-xxxx
Channel:	6
Connection Status:	Connected

and if so I wonder why my internet security is still saying this is vulnerable

thx

[schumaku]

Well, Netgear has still (!!!!) not managed to update the vulnerable Portable UPnP SDK from around 2012/2013 to something more up2date obviously on these Wireless Extenders. @ChristineT - send more product managers to Tasmania please.

[StephenB]

FWIW, I reported it here: https://bugcrowd.com/netgearkudos with a link to the forum thread.