Netgear router vulnerabilities could let attackers 'roam untethered through an entire organization'

Netgear Logo
Netgear Logo (Image credit: Netgear)

What you need to know

  • Microsoft discovered three vulnerabilities in Netgear routers that could lead to identity theft and full system compromise.
  • Netgear has already fixed the critical security issues.
  • The issues affect Netgear DGN-2200v1 routers.

Microsoft disclosed several vulnerabilities to Netgear routers that could allow attackers to "roam untethered through an entire organization," according to the Microsoft 365 Defender Research Team. A post (opens in new tab) from that team breaks down the vulnerabilities. The vulnerabilities were patched before they were disclosed publicly.

There are three bugs that affect Netgear DGN-2200v1 series routers that are running firmware lower than v1.0.0.60. Microsoft's staff noticed the bugs due to an "odd behavior:"

A device owned by a non-IT personnel was trying to access a NETGEAR DGN-2200v1 router's management port. The communication was flagged as anomalous by machine learning models, but the communication itself was TLS-encrypted and private to protect customer privacy, so we decided to focus on the router and investigate whether it exhibited security weaknesses that can be exploited in a possible attack scenario.

Microsoft explains that the first issue allows for a "complete and fully reliable authentication bypass." This is due to the issue allowing an attacker to access any page on the vulnerable device.

The second issue allows for a side-channel attack that can be used to get authentication credentials.

The final issue allows attackers to gain access to secrets stored in the device. "After some preparatory steps, the contents are DES-encrypted with a constant key "NtgrBak," explains Microsoft. "This allows an attacker to get the plaintext password (which is stored in the encrypted NVRAM) remotely. The user name, which can very well be variations of 'admin', can be retrieved the same way."

The critical issues have been fixed by Netgear already. The company outlines the fixes in more detail in a recent post (opens in new tab).

Sean Endicott
News Writer and apps editor

Sean Endicott brings nearly a decade of experience covering Microsoft and Windows news to Windows Central. He joined our team in 2017 as an app reviewer and now heads up our day-to-day news coverage. If you have a news tip or an app to review, hit him up at sean.endicott@futurenet.com (opens in new tab).

1 Comment
  • Big oof. Glad I moved to a Draytek mesh set up. Consumer grade hardware don't get firmware updates to often. Since I've owned the routers. Multiple almost a dozen firmware updates have been released. Some in the space of a month.