Netgear speaks out on new vulnerabilities, firmware updates available for most devices

Update (02/02/17): Following on from our initial report on the new security vulnerabilities found in Netgear routers, the company got in touch with us to provide a fresh statement on the matter and clear a few things up. Recently, two new vulnerabilities were made public by security researcher TrustWave, making some Netgear routers open to botnets amongst other things. However, it turns out that Netgear has been issuing fixes for these problems since June:

“NETGEAR is aware of the vulnerability (CVE-2017-5521), that has been recently publicized by TrustWave. This is not a new or recent development. We have been working with the security analysts to evaluate the vulnerability from the time they first contacted us. After being notified of the vulnerability in April, we released the first batch of fixes in June and prioritized the products based on the greatest number of customers or shipments.”

“Since that time we have continued to release fixes for the remaining products, most of which are older obsolete products with a smaller install base, although it is important to note that we notified users of workarounds for all affected products contemporaneously with the first batch of fixes in June, so no one would be vulnerable pending the remaining fixes. ”

Right now, there are firmware fixes available for the majority of affected Netgear devices, patching the password recovery vulnerability and more. You can find the list of firmware fixes by device at Netgear's Knowledge Base page.

Original Story (31/1/17): Back in December, security researchers revealed a fairly major security flaw present in a bunch of Netgear routers, leaving them open to hacking. Netgear swiftly took action, patching all routers just a week later but unfortunately, it appears the company's security still isn't quite tight enough as this week, researchers lifted the lid on two new vulnerabilities. This time, researchers have discovered  a backdoor for botnets as well as a way for anyone to reset a router's admin password.

The initial report came from research firm ‘TrustWave', which points out that you are only susceptible to these exploits if you have enabled remote administrative access or if the attacker has access to your local network.

Around 31 Netgear router models are affected in total, including higher-end routers like the Nighthawk. Fortunately, Netgear is once again taking swift action, 19 models out of the 31 have already been given firmware updates to patch the flaws. If you don't want to update your firmware for some reason, then you can always manually enable password recovery and turn off remote management to avoid security issues.

Discuss on our Facebook page, HERE. 

KitGuru Says: Right now, there is probably a good number of affected routers out in the wild open to these exploits. However, it seems that Netgear should have firmware updates out for all affected routers relatively soon. You can find the full list of affected routers and firmware updates, HERE. 

Become a Patron!