Researchers discovered an unpatched zero-day vulnerability with 79 Netgear routers that could allow attackers to take control of the device remotely.
The bug allowed attackers to execute arbitrary code as "root" users and to take complete control of the device remotely.
79 Vulnerable Netgear router models
The vulnerabilities were discovered by two security researchers, Adam Nichols from GRIMM and d4rkn3ss from Internet Service Provide VNPT.
Nicholas discovered that the vulnerability could affect 758 different firmware versions running on 79 Netgear routers. The firmware was released in 2007.
The vulnerability is reported to be in the HTTPD service, which listens on TCP port 80 by default. The problem is due to the incorrect validation of "user-supplied data before copying to a batch-based, fixed-length buffer".
The vulnerability enables hackers to run arbitrary code on vulnerable devices as a root user. Authentication is not required to exploit this vulnerability.
Adam Nichols analyzed the security vulnerability Netgear R7000 version 220.127.116.11 firmware and extracted the root file system from the firmware image using the binwalk.
The vulnerability can only be exploited with the older versions. This vulnerability would not be exploitable in modern software because modern software typically contains batch cookies.
The researchers also developed an exploit that served as a CSRF attack: "If a user navigates to a malicious website with a vulnerable router, that website can take advantage of the user's router."
Routers and modems are important security barriers that prevent attacks from directly exploiting the computers in a network.
Affected router models;
You can follow us on Linkedin, Twitter, Facebook for daily information on cybersecurity and message hacking.
New Mozi P2P botnet attacks Netgear, GPON, D-Link and Huawei routers with weak passwords and some known exploits
Multiple vulnerabilities with NETGEAR wireless routers allow attackers to access sensitive information