Netgear has released firmware updates for more than a dozen of its smart switches used on corporate networks to address high-severity vulnerabilities.
The company fixed three security flaws that affect 20 Netgear products, mostly smart switches. Technical details and proof-of-concept (PoC) exploit code for two of the bugs are publicly available.
An advisory from Netgear on Friday informs that a new firmware version is available for some of its switches impacted by three security vulnerabilities that received severity scores between 7.4 and 8.8 on a scale of 10.
Netgear identifies the bugs as PSV-2021-0140, PSV-2021-0144, PSV-2021-0145, as tracking numbers have yet to be assigned. Many of the affected products are smart switches, some of them with cloud management capabilities that allow configuring and monitoring them over the web.
Netgear’s advisory leaves out any technical details about the bugs but “strongly recommends that you download the latest firmware as soon as possible.”
Also Read: Data Protection Officer Singapore | 10 FAQs
Security researcher Gynvael Coldwind, who found and reported the vulnerabilities, today explained two of the issues and provided demo exploit code for them.
Coldwind says in his security report that one of the flaws, which the researcher calls Demon’s Cries, is an authentication bypass that could, under certain conditions, allow an attacker to take control of a vulnerable device.
A prerequisite for exploiting this bug is that the Netgear Smart Control Center (SCC) feature is active. Default configurations have it turned off.
Netgear calculated a severity score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for this vulnerability, noting that an attacker should be on the local network (Attack Vector: Adjacent) to be able to exploit it.
The researcher disagrees and marks the severity of this vulnerability as critical at 9.8. He argues that the specifications for version 3.1 of the Common Vulnerability Scoring System notes that the Attack Vector: Network (over the internet) should be used even for the intranet attacks:
“Network should be used even if the attacker is required to be on the same intranet to exploit the vulnerable system (e.g., the attacker can only exploit the vulnerability from inside a corporate network).”
However, a remote attacker would need the help of a user on the network (e.g. access a website with malicious code executed through the web browser to target the vulnerable switch) to exploit the flaw. This drops the severity security score to 8.8.
The second vulnerability that Coldwind detailed today got the name Draconian Fear and is what he defines as an “authentication hijacking (for lack of a better term).” The description accounts for an attack where a threat actor would need the same IP address as an admin to “hijack the session bootstrapping information.”
Also Read: Practitioner Certificate In Personal Data Protection: Everything You Need To Know
As a result, the attacker would have full admin access to the device’s web user interface, giving them complete control over the device.
Talking to BleepingComputer, the researcher says that this flaw is “more interesting than dangerous” because of the need to hijack an admin’s local IP address.
Details about the third vulnerability, which received the name Seventh Inferno, will become available on September 13.
Role of Enhanced Access Controls in Safeguarding Personal Data in Telecommunications that every Organisation in…
Effective Incident Response Procedures in Strengthening Data Security that every Organisation in Singapore should know…
Crucial Role of Regular Vulnerability Scanning that every Organisation in Singapore should know. Strengthening Your…
Enhancing Data Security with Multi-Factor Authentication that every Organisation in Singapore should know. Enhancing Data…
Strong Password Policy as a first line of defense against data breaches for Organisations in…
Importance of Efficient Access Controls that every Organisation in Singapore should take note of. Enhancing…
This website uses cookies.
