A variety of Netgear router models are vulnerable to a simple hack that allows attackers to take almost complete control of the devices, security experts warned over the weekend.
The critical bug allows remote attackers to inject highly privileged commands whenever anyone connected to the local Netgear network clicks on a malicious Web link, a researcher who uses the online handle Acew0rm reported on Friday. The link, which can be disguised to appear innocuous, then injects a command that routers run as root. The devices' failure to properly filter out input included in Web requests allows attackers to run powerful shell commands. Netgear R7000, R6400, and R8000 models have been confirmed to be vulnerable, and other models, including the R7000P, R7500, R7800, R8500 R9000, have been reported by end users as being affected\]
]\\\\\\\\\\\\\\].
"Exploiting this vulnerability is trivial," officials with CERT, the federally funded vulnerability coordination service, warned in an advisory published Friday . "Users who have the option of doing so should strongly consider discontinuing use of affected devices until a fix is made available."
A temporary fix is also possible. Ironically, it involves exploiting the vulnerability in a safe way to issue a command that turns off the router's Web server. The command can be issued by clicking on a simple linksimilar to this one, where [router-address] is replaced with the local IP address assigned to the router. While the command disables the internal Web the router uses to receive incoming commands, the router itself will otherwise continue to work normally. The temporary workaround is effective only until the router is restarted, because the Web server will be enabled each time the device is rebooted.The simple exploit published by Acew0rm is powerful because it works without any sort of authentication and works even when vulnerable routers don't have their remote management interfaces exposed to the Internet. To bypass the authentication requirement, the exploit carries out a cross-site request forgery , a hacking technique that injects unauthorized commands into a Web application by exploiting the trust it has in a user's browser. The Netgear vulnerability is the result of the Web interface failing to filter out potentially malicious commands contained in Web URLs.
Netgear officials have confirmed the vulnerability in the R8000, R7000, and R6400 models, but the company has yet to say if other models are also affected. People who want to check the status of their particular Netgear device can visit a link similar tothis one, again where [router-address] is replaced with the router's local IP address. If the page that loads shows anything other than an error or blank page, the router is likely vulnerable. Netgear has yet to issue a public fix. The temporary fix above is effective as long as the device isn't rebooted, but the safer bet is to remove vulnerable devices from networks until a patch is available.