NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Avast Vulnerability Catalogue ID CVE-2017-14491 for the Nighthawk R7000 ac1900 dualband wifi router
I have got this report from Avast and Bitdefender after scanning my network and i have the latest firmware for my router. Any ideas if Netgear is working on a firmware update f...
For the subject CVE-2017-14491 plus a few more items to address should be 2.78 or higher. Check http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
I'm wondering how it is that there can be such differences in the versions of dnsmasq in various models firmware. I have an R6400 (v1) which uses dnsmasq version 2.15 (released in 2004) in it's latest and it appears in all firmware ever released for this model. How does a router model released in 2015 get firmware compiled using such incredibily outdated source? Why do I see older models with newer versions? WTF is the dev process here? There are older routers listed that use far newer versions but I'm not sure any of Netgears use anything post 2.78 yet. In fact it seems that Netgear is actively ignoring this verified and published CVE from over half a year ago. There's another thread where a mod (who I just called out in a personal message) closed right away claiming it to be a false positive. There are other routers of other brands where ludicrous responses are given on this CVE as well. Honestly I don't care at this point if it is a false (it's not), I'm fed up with the handling and dev of firmware in general. Digging so deep into this has really exposed to me the ludicrous manner in which Netgear devs compile firmware. All open sources like dnsmasq should be based on the latest (stable) versions. I'm getting pretty PO'd about this whole thing. 20+ years a Netgear relationship as a customer and before that Bay. Maybe the real solution here is I go to dd-wrt on this particular unit. I'm surely at this point not going to be purchasing another or in my consultant capacity pushing any Netgear hardware, period.
As of this response from tier2 support on June 30:
I got an update from our Engineering team and they have confirmed that the R6900P router is not affected by the DNSMasq Vulnerability.
It is easy to make the problem go away by saying there is no problem. My dnsmasq is 2.75 - Avast Vulnerability Catalogue ID CVE-2017-14491 says my 6 month old Netgear router is vulnerable. I agree that it should be a priority to use the latest updates (dnsmasq 2.78 or later) to eliminate the problem or concern.
My R7000 AC1900 still has DNSmasq vs 2.15. Hoping that they get this updated soon. Really bad for business to no perform updates to customer systems for a vulnerability that is over a year and a half old.
Hoping isn't going to make it happen. We need to be on them about this nonsense. I was checking over the source for my R6400 which indicates a team "kathy", so I don't know if a "kathy" is responsible here or if it is indeed a team with kathy as leader. Whatever the case, as manufacturers of this hardware they are beholden to provide fixes to security issues. Compiling firmware from source that is 14 years old is negligent.