router remote code injection vulnerability

10 posts / 0 new
Last post
replabrobin
router remote code injection vulnerability

This vulnerability https://www.kb.cert.org/vuls/id/582384 certainly affects my router with stock firmware updated to latest. Anyone know if netgear is intending a fix any time soon. Apparently it was revealed to netgear 4 months ago.

microchip
no one can say at the moment

no one can say at the moment how fast NG will push an update. But being familiar with them, it can take a few weeks or up to a month. I will be pleasantly surprised if they act very fast which will be good for all affected

nekton23
Does anyone know if the same

Does anyone know if the same vulnerability exists in recent Tomato Shibby open firmware versions?

DrLDR70
Terminate the web server

Terminate the web server process, with?:

http://<Router_IP_Address>;killall$IFS'httpd'
 

AntonK
Likewise for DD-WRT Kong mod?

Likewise for DD-WRT Kong mod?

microchip
Only stock firmware is

Only stock firmware is affected, not DDWRT or Tomato

nekton23
Thanks.

Thanks.

AntonK
Netgear has a beta update out

Netgear has a beta update out today that fixes the issue.

https://www.netgear.com/support/product/R7000#Firmware Version 1.0.7.6 (Beta)

 

AntonK

microchip
Yes, after months of knowing

Yes, after months of knowing about the issue AND after the person who discovered it went public, NG is finally moving its ass. Will make me thing twice or thrice before recommending NG to others

replabrobin
I wonder if they only

I wonder if they only responded after the slashdot article and my comment here seems a bit coincidental otherwise.