- Netgear faces a pre-authentication buffer overflow vulnerability affecting some of its devices with a high CVSS score of 7.4.
- The vulnerabilities are already fixed with the latest firmware updates. However, the customers need to apply those updates manually.
- Netgear strongly recommends downloading and installing the latest firmware as soon as possible in order to avoid possible attacks.
Netgear, the network hardware company, recently discovered a vulnerability that affects some of its devices. Some of the devices are affected by pre-authentication buffer overflow vulnerability with a CVSS score of 7.4 and the company has released fixes for affected models. The pre-authentication buffer overflow vulnerability remains if you do not apply the fixes and Netgear urges its customers to apply the patches immediately.
Vulnerable models
The devices that got the pre-authentication buffer overflow vulnerability can be found below:
- RAX40
- RAX35
RAX75 RAX80 R7000 R7000P R7960P R8000P - R6400v2
- R6700v3
- R6900P
- R7000P
- R7000
- R7960P
- R8000P
Netgear strongly recommends downloading the latest firmware as soon as possible to not face any security issues.
Update the firmware on your vulnerable device
- Visit NETGEAR Support.
- Start typing your model number in the search box, then select your model from the drop-down menu as soon as it appears. If you do not see a drop-down menu, make sure that you entered your model number correctly, or select a product category to browse for your product model.
- Click Downloads.
- Under Current Versions, select the download whose title begins with Firmware Version.
- Click Download.
- Follow the instructions in your product’s user manual, firmware release notes, or product support page to install the new firmware.
If your product is supported by one of their apps, using the app is the easiest way to update your firmware:
- Orbi products: NETGEAR Orbi app
- NETGEAR WiFi routers: NETGEAR Nighthawk app
- Some NETGEAR Business products: NETGEAR Insight app.
Netgear had an issue with another vulnerability in early 2022 that we have also covered.