Available here: RBR50 / RBS50 Firmware Version 2.6.1.40 | Answer | NETGEAR Support New Features and Enhancements:Supports HTTPS on the LANSecurity Fixes:Fixes security issuesWhen there are no user issues fixed does that mean there are no user issues to fix? :smileylol:

I'm not sure if it has a "beta" tag but it is official and as far as I'm aware NG don't do "beta" public releases... Orbi RBK50 | WiFi System | NETGEAR Support

Well, wanted to try v40 on my RBK50 series with the RBS50 ethernet connected. ARP storm is happening on v40 as well...ARP Storm with v40: Downgraded to v16 which was working well last time...No ARP Storm with v16 loaded: So I recommend for users of the 50 series Orbi who have RBS ethernet connected with a switch or more, keep v16 loaded. Hopefully NG can fix this in future updates. Blanca_O

Nothing is mandatory unless pushed to the device by Netgear without user intervention. That happens very rarely. You can check the release notes (which doesn't say much), and security bulletins at https://www.netgear.com/about/security/ and see if you are up to updating the devices manually following the instructions here https://kb.netgear.com/31573/How-do-I-manually-upgrade-firmware-on-my-Orbi-router-using-orbilogin-com JitM wrote: SInce my app is not showing this version does it mean this is not mandatory version for me to upgrade? Cheers,JM

This is a rare instance when NG has documented a problem and the fix for it. Lets not fight it. Making users aware of this is a a good thing. This way, users can look up the details of the security issue, decide how serious it is, and whether to update their firmware to 2.6.1.40 or newer (for RBK50's). security_advisory_for_unauthenticated_command https://nvd.nist.gov/vuln/detail/CVE-2020-27861 "This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076"NIST severity score = 8.8/10 (High)

RBR50 / RBS50 Firmware Version 2.6.1.40

26 Replies

wimmme
Tutor
Oct 28, 2020
Is this official or beta firmware ? I just updated to 2.5.2.4 2 days ago !
- DatabaseJase
  Luminary
  Oct 28, 2020
  I'm not sure if it has a "beta" tag but it is official and as far as I'm aware NG don't do "beta" public releases...
  
  Orbi RBK50 | WiFi System | NETGEAR Support
Ha_Ku_Na
Luminary
Oct 30, 2020
The "New Features and Enhancements" section is confusing:
Supports HTTPS on the LAN
What should that mean ? If I'm using https internally, then I use it and it is already working (browser and REST calls).

Anyway, I reverted from 2.5.2.4 to 2.5.1.16 because this is the most actual FW which is working on my environment (1 RBR & 1 RBS wired and 2 RBS via backhaul).

Would be interesting, if someone already upgraded to 2.6.1.40 and what the experience is ?
- are the connected Devices displayed correctly (mobile appp & browser)
- stability
...
- NewGuy25
  Aspirant
  Nov 10, 2020
  Ha_Ku_Na wrote:
  The "New Features and Enhancements" section is confusing:
  Supports HTTPS on the LAN
  What should that mean ? If I'm using https internally, then I use it and it is already working (browser and REST calls).
  
  Anyway, I reverted from 2.5.2.4 to 2.5.1.16 because this is the most actual FW which is working on my environment (1 RBR & 1 RBS wired and 2 RBS via backhaul).
  
  Would be interesting, if someone already upgraded to 2.6.1.40 and what the experience is ?
  - are the connected Devices displayed correctly (mobile appp & browser)
  - stability
  ...
  
  Experiencing issues when loading up ebay.co.uk after the update. Any device connected to the network cannot seem to load up the css for ebay.co.uk
  - timch
    Luminary
    Nov 10, 2020
    I've been running this for about a week or so with no problems; it seems really solid and the app works as expected. I've checked eBay.co.uk just now and it's loads perfectly.
    I have an RBR50 and 2 RBS50 connected wirelessly and an RBS40 connected on Ethernet.
faizankhan85
Aspirant
Nov 10, 2020
Hello All

Quick question in relation to firmware update to 2.6.1.40:

I am currently on 2.5.1.16 so should I first update to 2.5.2.4 or can I direectly update to 2.6.1.40?

Thanks!
- FURRYe38
  Guru
  Nov 10, 2020
  You can directly.
  - faizankhan85
    Aspirant
    Nov 10, 2020
    Thank you for your fast response!
jijun1964
Guide
Nov 14, 2020
RBR50 and RBS50 Firmware 2.6.1.40 just update manually, update smoothly , all connected device show properly, vary stable. Thank You. for provide update firmware continuously.
- Ha_Ku_Na
  Luminary
  Nov 14, 2020
  Could you please also post some deatils of your configuration ?
  like:
  - are you using the Orbi system in Router or AP mode ?
  - Are you using "Access Control" ?
  - Are you using "Port Forwarding" ?
  - Are you using "Dynamic DNS" ?
  - Have you configured "VPN Service" ?
  - Are you using "LAN Address reservation (bind MAC to a fix IP address) ?
  - Have you done a factory reset after the upgrade ?
  
  Because I think the mode can make a big difference regarding stability.
  I use it in Router mode because this makes it easier to change the internet provider.
  - FURRYe38
    Guru
    Nov 18, 2020
    Well, wanted to try v40 on my RBK50 series with the RBS50 ethernet connected.
    ARP storm is happening on v40 as well...
    ARP Storm with v40:
    
    Downgraded to v16 which was working well last time...
    No ARP Storm with v16 loaded:
    
    So I recommend for users of the 50 series Orbi who have RBS ethernet connected with a switch or more, keep v16 loaded. Hopefully NG can fix this in future updates.
    
    Blanca_O
LilianMoraru
Aspirant
Dec 28, 2020
"Security issues" is "user issues".
You login over HTTPS by default, which is a good security practice that they didn't follow up to this point.

My issue with it: 2.6.1.40 changed my password and I can't login into it any more...
- FURRYe38
  Guru
  Dec 28, 2020
  Besure to clear out all browser caches before going to the RBRs web page.
  Be sure your typing in the correct PW values.
  Try a different browser to compare.
  
  Factory reset the RBR and setup from scratch as last resort.
  LilianMoraru wrote:
  "Security issues" is "user issues".
  You login over HTTPS by default, which is a good security practice that they didn't follow up to this point.
  
  My issue with it: 2.6.1.40 changed my password and I can't login into it any more...
  - LilianMoraru
    Aspirant
    Dec 28, 2020
    I never type the password manually, I use a password manager.
    I had to do a password reset by manually introducing the serial number.
JitM
Aspirant
Jan 03, 2021
Hi,

I have same ORBI setup at home RBR50 and RBS50.

I never done any manually firmware updates, I always use smartphone app to check for updates and then update them if available.

My current version is 2.5.2.4 and smartphone app is not showing me this new update if I use check for new updates. It is showing my firmware is up to date.

But it is clear that Netgear has relased this version 2.6.1.40 which i can see in their download section as well.

SInce my app is not showing this version does it mean this is not mandatory version for me to upgrade?

Cheers,
JM
- alokeprasad
  Mentor
  Jan 03, 2021
  Nothing is mandatory unless pushed to the device by Netgear without user intervention. That happens very rarely.
  
  You can check the release notes (which doesn't say much), and security bulletins at https://www.netgear.com/about/security/ and see if you are up to updating the devices manually following the instructions here
  
  https://kb.netgear.com/31573/How-do-I-manually-upgrade-firmware-on-my-Orbi-router-using-orbilogin-com
  
  JitM wrote:
  
  SInce my app is not showing this version does it mean this is not mandatory version for me to upgrade?
  
  Cheers,
  JM
  - FURRYe38
    Guru
    Feb 23, 2021
    https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems-PSV-2020-0301

Forum Discussion

RBR50 / RBS50 Firmware Version 2.6.1.40