Firmware Flaw Leaves Netgear Routers Vulnerable To Hacker Takover

Netgear R7000, R6400 and R8000 routers have been found to contain a flaw that could enable them to be exploited and taken over by hackers and cyber criminals.

Through exploiting a command injection flaw would -be hackers can execute arbitrary code on the router’s firmware and wreak havoc with the user’s network.

Netgear security flaw

Twitter user Acew0rm1 was responsible for finding the flaw but had shed little light yet on how the vulnerability was discovered.

Netgear said it is investigation the flaw but has yet to reveal much in the way it plans to fix the flaw or rollout a firmware update to seal the security hole.

“Netgear has recently become aware of the security issue #582384 that allows unauthenticated web pages to pass form input directly to the command-line interface. A remote attacker can potentially inject arbitrary commands which are then executed by the system,” the company said.

Given no list of vulnerable router models has been put out in circulation, it is difficult for users of Netgear users to understand what to do next to bypass the problem.

The computer emergency response team (CERT) has advised people with Netgear routers to stop using the device until more security details are revealed and the company moves to fix the flaw.

“Exploiting this vulnerability is trivial. Users who have the option of doing so should strongly consider discontinuing use of affected devices until a fix is made available,” CERT said.

Such flaws in routers are particularly dangerous and no only do they expose a network to being taken over but hacked routers and also be used to form a botnet with other seized devices from which distributed denial of service (DDoS) attacks can be launched from, as seen with the Mirai bot net, as well as help spread malware.

The Mirai botnet appears to have been responsible for such DDoS attacks as the one aimed at Talk Talk and the Post Office which took down the companies’ broadband services, as well as flatten services such as Twitter and Spotify when it was used to knock out DNS servers supporting the popular web services.

As the spread of the Internet of Things (IoT) gathers pace, such vulnerabilities at the firmware level in hardware are likely to crop up more regularly unless action on encryption standards and certification are established before the spread of such connected devices become more pervasive.

Are you a security pro? Try our quiz!

Roland Moore-Colyer

As News Editor of Silicon UK, Roland keeps a keen eye on the daily tech news coverage for the site, while also focusing on stories around cyber security, public sector IT, innovation, AI, and gadgets.

Recent Posts

X’s Community Notes Fails To Stem US Election Misinformation – Report

Hate speech non-profit that defeated Elon Musk's lawsuit, warns X's Community Notes is failing to…

1 day ago

Google Fined More Than World’s GDP By Russia

Good luck. Russia demands Google pay a fine worth more than the world's total GDP,…

1 day ago

Spotify, Paramount Sign Up To Use Google Cloud ARM Chips

Google Cloud signs up Spotify, Paramount Global as early customers of its first ARM-based cloud…

2 days ago

Meta Warns Of Accelerating AI Infrastructure Costs

Facebook parent Meta warns of 'significant acceleration' in expenditures on AI infrastructure as revenue, profits…

2 days ago

AI Helps Boost Microsoft Cloud Revenues By 33 Percent

Microsoft says Azure cloud revenues up 33 percent for September quarter as capital expenditures surge…

2 days ago