NETGEAR Updates
1837Warning Date
Severity Level
Warning Number
Target Sector
23 December, 2021
● High
2021-4135
All
Description:
NETGEAR has released security updates to address multiple vulnerabilities in the following products:
- D7000v2, running firmware versions prior to 1.0.0.66
- D8500, running firmware versions prior to 1.0.3.58
- R7000, running firmware versions prior to 1.0.11.110
- R7100LG, running firmware versions prior to 1.0.0.72
- R7900, running firmware versions prior to 1.0.4.30
- R8000, running firmware versions prior to 1.0.4.62
- XR300, running firmware versions prior to 1.0.3.56
- R7000P, running firmware versions prior to 1.3.2.132
- R8500, running firmware versions prior to 1.0.2.144
- R6900P, running firmware versions prior to 1.3.2.132
- R8300, running firmware versions prior to 1.0.2.144
- R7000, running firmware versions prior to 1.0.11.126
- R7960P, running firmware versions prior to 1.4.2.84
- R8000, running firmware versions prior to 1.0.4.74
- RAX200, running firmware versions prior to 1.0.4.120
- R8000P, running firmware versions prior to 1.4.2.84
- RAX20, running firmware versions prior to 1.0.2.82
- RAX45, running firmware versions prior to 1.0.2.82
- RAX80, running firmware versions prior to 1.0.4.120
- R7900P, running firmware versions prior to 1.4.2.84
- RAX15, running firmware versions prior to 1.0.2.82
- RAX50, running firmware versions prior to 1.0.2.82
- RAX75, running firmware versions prior to 1.0.4.120
- D6220, running firmware versions prior to 1.0.0.66
- D6400, running firmware versions prior to 1.0.0.100
- DC112A, running firmware versions prior to 1.0.0.52
- DGN2200v4, running firmware versions prior to 1.0.0.118
- EAX80, running firmware versions prior to 1.0.1.64
- R6250, running firmware versions prior to 1.0.4.48
- R7960P, running firmware versions prior to 1.4.1.64
- RAX200, running firmware versions prior to 1.0.3.106
- RS400, running firmware versions prior to 1.5.1.80
- XR300, running firmware versions prior to 1.0.3.68
- R6400v2, running firmware versions prior to 1.0.4.106
- R8000P, running firmware versions prior to 1.4.1.64
- RAX80, running firmware versions prior to 1.0.3.106
- R6700v3, running firmware versions prior to 1.0.4.106
- R7900P, running firmware versions prior to 1.4.1.64
- RAX75, running firmware versions prior to 1.0.3.106
- R6400, running firmware versions prior to 1.0.1.68
- WNDR3400v3, running firmware versions prior to 1.0.1.38
- R7000P, running firmware versions prior to 1.3.3.140
- R6900P, running firmware versions prior to 1.3.3.140
- D7800, running firmware versions prior to 1.0.1.64
- EX6200v2, running firmware versions prior to 1.0.1.86
- EX6250, running firmware versions prior to 1.0.0.134
- EX7700, running firmware versions prior to 1.0.0.216
- EX8000, running firmware versions prior to 1.0.1.232
- LBR20, running firmware versions prior to 2.6.3.50
- R7800, running firmware versions prior to 1.0.2.80
- R8900, running firmware versions prior to 1.0.5.26
- R9000, running firmware versions prior to 1.0.5.26
- RAX120, running firmware versions prior to 1.2.0.16
- RBS50Y, running firmware versions prior to 1.0.0.56
- WNR2000v5, running firmware versions prior to 1.0.0.76
- XR450, running firmware versions prior to 2.3.2.114
- XR500, running firmware versions prior to 2.3.2.114
- XR700, running firmware versions prior to 1.0.1.36
- EX6150v2, running firmware versions prior to 1.0.1.98
- EX7300, running firmware versions prior to 1.0.2.158
- EX7320, running firmware versions prior to 1.0.0.134
- EX6100v2, running firmware versions prior to 1.0.1.98
- EX6400, running firmware versions prior to 1.0.2.158
- EX7300v2, running firmware versions prior to 1.0.0.134
- EX6410, running firmware versions prior to 1.0.0.134
- RBR10, running firmware versions prior to 2.6.1.44
- RBR20, running firmware versions prior to 2.6.2.104
- RBR40, running firmware versions prior to 2.6.2.104
- RBR50, running firmware versions prior to 2.7.2.102
- EX6420, running firmware versions prior to 1.0.0.134
- RBS10, running firmware versions prior to 2.6.1.44
- RBS20, running firmware versions prior to 2.6.2.104
- RBS40, running firmware versions prior to 2.6.2.104
- RBS50, running firmware versions prior to 2.7.2.102
- EX6400v2, running firmware versions prior to 1.0.0.134
- RBK12, running firmware versions prior to 2.6.1.44
- RBK20, running firmware versions prior to 2.6.2.104
- RBK40, running firmware versions prior to 2.6.2.104
- RBK50, running firmware versions prior to 2.7.2.102
- EX7700, running firmware versions prior to 1.0.0.222
- RBS50Y, running firmware versions prior to 2.7.3.22
- XR450, running firmware versions prior to 2.3.2.66
- XR500, running firmware versions prior to 2.3.2.66
- RAX120, running firmware versions prior to 1.2.2.24
- RAX120v2, running firmware versions prior to 1.2.2.24
- RBR10, running firmware versions prior to 2.7.3.22
- RBR20, running firmware versions prior to 2.7.3.22
- RBR40, running firmware versions prior to 2.7.3.22
- RBR50, running firmware versions prior to 2.7.3.22
- RBS10, running firmware versions prior to 2.7.3.22
- RBS20, running firmware versions prior to 2.7.3.22
- RBS40, running firmware versions prior to 2.7.3.22
- RBS50, running firmware versions prior to 2.7.3.22
- RBK12, running firmware versions prior to 2.7.3.22
- RBK20, running firmware versions prior to 2.7.3.22
- RBK40, running firmware versions prior to 2.7.3.22
- RBK50, running firmware versions prior to 2.7.3.22
- LBR1020, running firmware versions prior to 2.6.3.58
- RAX10, running firmware versions prior to 1.0.2.88
- RAX70, running firmware versions prior to 1.0.2.88
- R6700AX, running firmware versions prior to 1.0.2.88
- RAX120v2, running firmware versions prior to 1.2.0.16
- RAX78, running firmware versions prior to 1.0.2.88
- RBR350, running firmware versions prior to 4.3.4.7
- RBS350, running firmware versions prior to 4.3.4.7
- RBK352, running firmware versions prior to 4.3.4.7
- D6220, running firmware versions prior to 1.0.0.68
- D6400, running firmware versions prior to 1.0.0.102
- DC112A, running firmware versions prior to 1.0.0.54
- EX7000, running firmware versions prior to 1.0.1.94
- EX7500, running firmware versions prior to 1.0.0.72
- R6300v2, running firmware versions prior to 1.0.4.52
- R6400, running firmware versions prior to 1.0.1.70
- R6400v2, running firmware versions prior to 1.0.4.102
- R6700v3, running firmware versions prior to 1.0.4.102
- R7000, running firmware versions prior to 1.0.11.116
- R7100LG, running firmware versions prior to 1.0.0.64
- R7850, running firmware versions prior to 1.0.5.68
- R7960P, running firmware versions prior to 1.4.1.68
- R8000, running firmware versions prior to 1.0.4.52
- RAX200, running firmware versions prior to 1.0.2.88
- RBS40V, running firmware versions prior to 2.6.2.4
- R7000P, running firmware versions prior to 1.3.2.124
- R8000P, running firmware versions prior to 1.4.1.68
- RAX80, running firmware versions prior to 1.0.3.102
- R6900P, running firmware versions prior to 1.3.2.124
- R7900P, running firmware versions prior to 1.4.1.68
- RAX75, running firmware versions prior to 1.0.3.102
- RBR750, running firmware versions prior to 3.2.17.12
- RBR850, running firmware versions prior to 3.2.17.12
- RBS750, running firmware versions prior to 3.2.17.12
- RBS850, running firmware versions prior to 3.2.17.12
- RBK752, running firmware versions prior to 3.2.17.12
- RBK852, running firmware versions prior to 3.2.17.12
- EX6100v2, running firmware versions prior to 1.0.1.106
- EX6150v2, running firmware versions prior to 1.0.1.106
- EX6250, running firmware versions prior to 1.0.0.146
- EX6400, running firmware versions prior to 1.0.2.164
- EX6400v2, running firmware versions prior to 1.0.0.146
- EX6410, running firmware versions prior to 1.0.0.146
- EX6420, running firmware versions prior to 1.0.0.146
- EX7300, running firmware versions prior to 1.0.2.164
- EX7300v2, running firmware versions prior to 1.0.0.146
- EX7320, running firmware versions prior to 1.0.0.146
- LBR1020, running firmware versions prior to 2.6.5.16
- LBR20, running firmware versions prior to 2.6.5.2
- D7000v2, running firmware versions prior to 1.0.0.74
- D8500, running firmware versions prior to 1.0.3.60
- DC112A, running firmware versions prior to 1.0.0.56
- R6300v2, running firmware versions prior to 1.0.4.50
- R7100LG, running firmware versions prior to 1.0.0.70
- RBS40V, running firmware versions prior to 2.6.2.8
- RBW30, running firmware versions prior to 2.6.2.2
- R7900, running firmware versions prior to 1.0.4.46
- R6400v2, running firmware versions prior to 1.0.4.118
- R6700v3, running firmware versions prior to 1.0.4.118
- CBR40, running firmware versions prior to 2.5.0.24
- CBR750, running firmware versions prior to 4.6.3.6
- EAX20, running firmware versions prior to 1.0.0.58
- EAX80, running firmware versions prior to 1.0.1.68
- EX7500, running firmware versions prior to 1.0.0.74
- LAX20, running firmware versions prior to 1.1.6.28
- R7900, running firmware versions prior to 1.0.4.38
- R8000, running firmware versions prior to 1.0.4.68
- XR1000, running firmware versions prior to 1.0.0.58
- MK62, running firmware versions prior to 1.0.6.116
- MR60, running firmware versions prior to 1.0.6.116
- RAX20, running firmware versions prior to 1.0.3.96
- MS60, running firmware versions prior to 1.0.6.116
- RAX15, running firmware versions prior to 1.0.3.96
- RAX45, running firmware versions prior to 1.0.3.96
- RAX50, running firmware versions prior to 1.0.3.96
- RAX43, running firmware versions prior to 1.0.3.96
- RAX40v2, running firmware versions prior to 1.0.3.96
- RAX35v2, running firmware versions prior to 1.0.3.96
- EAX20, running firmware versions prior to 1.0.0.48
- R7960P, running firmware versions prior to 1.4.1.66
- R8000, running firmware versions prior to 1.0.4.66
- MK62, running firmware versions prior to 1.0.6.110
- MR60, running firmware versions prior to 1.0.6.110
- R8000P, running firmware versions prior to 1.4.1.66
- RAX20, running firmware versions prior to 1.0.2.64
- MS60, running firmware versions prior to 1.0.6.110
- R7900P, running firmware versions prior to 1.4.1.66
- RAX15, running firmware versions prior to 1.0.2.64
- RBR750, running firmware versions prior to 3.2.16.22
- RBR850, running firmware versions prior to 3.2.16.22
- RBS750, running firmware versions prior to 3.2.16.22
- RBS850, running firmware versions prior to 3.2.16.22
- RBK752, running firmware versions prior to 3.2.16.22
- RBK852, running firmware versions prior to 3.2.16.22
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Buffer Overflow
- Command injection
- Information disclosure
Best practice and Recommendations:
The CERT team encourages users to review NETGEAR security advisory and apply the necessary updates:
- https://kb.netgear.com/000064485/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0298?article=000064485
- https://kb.netgear.com/000064486/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2020-0320?article=000064486
- https://kb.netgear.com/000064487/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2020-0322?article=000064487
- https://kb.netgear.com/000064488/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2020-0323?article=000064488
- https://kb.netgear.com/000064489/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0371?article=000064489
- https://kb.netgear.com/000064490/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0422?article=000064490
- https://kb.netgear.com/000064491/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0427?article=000064491
- https://kb.netgear.com/000064492/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0435?article=000064492
- https://kb.netgear.com/000064493/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0437?article=000064493
- https://kb.netgear.com/000064494/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0453?article=000064494
- https://kb.netgear.com/000064495/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0462?article=000064495
- https://kb.netgear.com/000064496/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-PSV-2020-0464?article=000064496
- https://kb.netgear.com/000064497/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0480?article=000064497
- https://kb.netgear.com/000064498/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2020-0499?article=000064498
- https://kb.netgear.com/000064499/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0506?article=000064499
- https://kb.netgear.com/000064505/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0156?article=000064505
- https://kb.netgear.com/000064509/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extender-WiFi-Systems-PSV-2020-0506?article=000064509