Pierluigi Paganini
September 06, 2021
Netgear has released firmware updates to address high-severity vulnerabilities in more than a dozen of its smart switches used on businesses.
The company fixed three security flaws that affect 20 Netgear products, mostly smart switches. Technical details and proof-of-concept (PoC) exploit code for two of the bugs are publicly available.
Netgear has addressed three vulnerabilities tracked by the vendor as PSV-2021-0140, PSV-2021-0144, PSV-2021-0145 that received a CVSS score between 7.4 and 8.8.
The flaws affected multiple products including the following smart switches, below is the list of the impacted devices and related firmware fixes:
Two of the vulnerabilities were reported by security researcher Gynvael Coldwind who also released a PoC exploit code for both issues.
I've published the reports for 2 of 3 recently patched NETGEAR vulnerabilities:https://t.co/RW8ufNBP2Ihttps://t.co/fXNUVuldh7
— Gynvael Coldwind (@gynvael) September 6, 2021
1st is just an auth bypass, but the 2nd – while not that risky – is pretty fun (in a facepalm kind of way).
3rd will be published on Sept 13th.
“NETGEAR GS110TPV3 Smart Managed Pro Switch with SCC Control enabled* is vulnerable to an authentication bypass resulting in the attacker being able to change admin’s password (among other things), resulting in a full compromise of the device.” explained Coldwind.
The experts pointed out that SCC Control (NETGEAR Smart Control Center) is disabled by default, and must be manually enabled in the web UI (Security > Management Security > SCC Control). The researcher also published a PoC code that changes the password to “AlaMaKota1234.”
NETGEAR on the advisory page rated the issue with a CVSS score of 8.8 (High), while Coldwind assigned it a score of 9.8 because “network should be used even if the attacker is required to be on the same intranet to exploit the vulnerable system (e.g., the attacker can only exploit the vulnerability from inside a corporate network).”
The second vulnerability reported by the expert is an authentication hijacking issue.
“NETGEAR GS110TPV3 Smart Managed Pro Switch is vulnerable to authentication hijacking (for lack of a better term) that allows an attacker with the same IP as a logging in admin to hijack the session bootstrapping information, giving the attacker full admin access to the device web UI and resulting in a full compromise of the device.” reads the advisory published by the researcher.”The obvious limiting factor here is the requirement for the attacker to either have the same IP as the admin (foothold on the same machine with limited privileges, same source NAT IP, etc) or being able to spoof the IP with various low-level network shenanigans, as well winning a race condition with a 1-second window (pretty easy actually).”
The researcher also released a PoC exploit that will attempt to win the race and hijack session bootstrap information.”
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Netgear)
[adrotate banner=”5″]
[adrotate banner=”13″]
