NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

DoctorX's avatar
DoctorX
Guide
Dec 18, 2016
Solved

Web GUI Password Recovery Vulnerability?

Back in June a security vulnerability was disclosed:

 

Web GUI Password Recovery and Exposure Security Vulnerability

https://community.netgear.com/t5/Nighthawk-WiFi-Routers/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability/td-p/1104237

 

It didn't seem to be addressed even in the most recent firmware release, v1.0.7.6_1.1.99,  which fixed the vulnerability disclosed in Security Advisory VU 582384.

Is there any update on this?

 

Thanks!

Firmware
Security

14 Replies

Sort By
    • AVJohnnie's avatar
      AVJohnnie
      Tutor
      Feb 01, 2017
      JamesGL wrote:

      Hi DoctorX,

       

      Web GUI Password Recovery has been addressed already. You may check the article below.

       

      http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability?cid=wmt_netgear_organic

       

       

      And what about those of us with the dubious honor of owning E.O.L. (aka, officially abandoned) Netgear devices such as the 1st rev. NightHawk R7500 (EOLed 12 months after inital release) --- So what of us? Are we collectively shoe-horned under the KB30632 (C.Y.A.) section jargon: "If your affected product does not have a firmware fix available, NETGEAR strongly recommends that you follow this workaround procedure to remediate the vulnerability" --- and once again Netgear's customer abandonment leaves us never really knowing if our devices were or were not, vulnerable? Because Netgear prefers not to "talk publicly" about matters they deem to be potentially embarrassing...

       

      It's getting harder and harder to justify continuance at being a Netgear customer...

      • StephenB's avatar
        StephenB
        Guru
        Feb 01, 2017
        AVJohnnie wrote:
        ... NightHawk R7500 ...

        That's not on the list at all, and isn't in the NIST CVE record either.  Are you sure it's affected by this particular vulnerability?

    • DoctorX's avatar
      DoctorX
      Guide
      Dec 19, 2016

      Is that the same vulnerability?

       

      The reason I ask is that the 1.0.5.70 firmware is dated 06/02/2016 and was released on 06/15/2016.

      The (frozen) post by ChristineT (admin) describing the unresolved issue was posted on 06/22/2016.

       

      If its the same issue can the original post be unfrozen and updated?

      • JamesGL's avatar
        JamesGL
        Master
        Dec 22, 2016

        Hi DoctorX,

         

        The recent report about vulnerability is different from the Web GUI password Recovery Vulnerability. Both issues has been addressed already.