Netgear has quietly decided not to patch more than 40 home routers to plug a remote code execution vulnerability – despite security researchers having published proof-of-concept exploit code.
The vuln was revealed publicly in June by Trend Micro’s Zero Day Initiative (ZDI) following six months spent chivvying Netgear behind the scenes to take it seriously.
Keen-eyed Reg readers, however, noticed that Netgear quietly declared 45 of the affected products as “outside the security support period” – meaning those items won’t be updated to protect them against the vuln.
America’s Carnegie-Mellon University summarised the vuln in a note from its Software Engineering Institute: “Multiple Netgear devices contain a stack buffer overflow in the httpd web server’s handling of upgrade_check.cgi, which may allow for unauthenticated remote code execution with root privileges.”
Stung by pressure from infosec researchers that came to a head in June when ZDI went public, Netgear began issuing patches. It had sorted out 28 of the 79 vulnerable product lines by the end of that month.
Infosec biz Grimm pitched in after independently discovering the vuln itself by publishing proof-of-concept exploits for the SOHO (Small Office/Home Office) devices.
With today’s revelation that 45 largely consumer and SME-grade items will never be patched, Netgear faces questions over its commitment to older product lines. Such questions have begun to be addressed in Britain by calls from government agencies for new laws forcing manufacturers to reveal devices’ design lifespans at the point of purchase.
[…]
Today Netgear’s advisory page for the patches shows 45 devices’ fix status as “none; outside security support period”. We have collected those devices’ model numbers in the list below:
- AC1450
- D6300
- DGN2200v1
- DGN2200M
- DGND3700v1
- LG2200D
- MBM621
- MBR1200
- MBR1515
- MBR1516
- MBR624GU
- MBRN3000
- MVBR1210C
- R4500
- R6200
- R6200v2
- R6300v1
- R7300DST
- WGR614v10
- WGR614v8
- WGR614v9
- WGT624v4
- WN2500RP
- WN2500RPv2
- WN3000RP
- WN3000RPv2
- WN3000RPv3
- WN3100RP
- WN3100RPv2
- WN3500RP
- WNCE3001
- WNCE3001v2
- WNDR3300v1
- WNDR3300v2
- WNDR3400v1
- WNDR3400v2
- WNDR3400v3
- WNDR3700v3
- WNDR4000
- WNDR4500
- WNDR4500v2
- WNR3500v1
- WNR3500Lv1
- WNR3500v2
- WNR834Bv2
Robin Edgar
Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft