Netgear addresses severe security flaws in 20 of its products

Netgear has released security updates to address high-severity vulnerabilities affecting several of its smart switches used by businesses.

Netgear has released firmware updates to address high-severity vulnerabilities in more than a dozen of its smart switches used on businesses.

The company fixed three security flaws that affect 20 Netgear products, mostly smart switches. Technical details and proof-of-concept (PoC) exploit code for two of the bugs are publicly available.

Netgear has addressed three vulnerabilities tracked by the vendor as PSV-2021-0140, PSV-2021-0144, PSV-2021-0145 that received a CVSS score between 7.4 and 8.8.

The flaws affected multiple products including the following smart switches, below is the list of the impacted devices and related firmware fixes:

GC108P fixed in firmware version 1.0.8.2GC108PP fixed in firmware version 1.0.8.2GS108Tv3 fixed in firmware version 7.0.7.2GS110TPP fixed in firmware version 7.0.7.2GS110TPv3 fixed in firmware version 7.0.7.2GS110TUP fixed in firmware version 1.0.5.3GS308T fixed in firmware version 1.0.3.2GS310TP fixed in firmware version 1.0.3.2GS710TUP fixed in firmware version 1.0.5.3GS716TP fixed in firmware version 1.0.4.2GS716TPP fixed in firmware version 1.0.4.2GS724TPP fixed in firmware version 2.0.6.3GS724TPv2 fixed in firmware version 2.0.6.3GS728TPPv2 fixed in firmware version 6.0.8.2GS728TPv2 fixed in firmware version 6.0.8.2GS750E fixed in firmware version 1.0.1.10GS752TPP fixed in firmware version 6.0.8.2GS752TPv2 fixed in firmware version 6.0.8.2MS510TXM fixed in firmware version 1.0.4.2MS510TXUP fixed in firmware version 1.0.4.2

Two of the vulnerabilities were reported by security researcher Gynvael Coldwind who also released a PoC exploit code for both issues.

“NETGEAR GS110TPV3 Smart Managed Pro Switch with SCC Control enabled* is vulnerable to an authentication bypass resulting in the attacker being able to change admin’s password (among other things), resulting in a full compromise of the device.” explained Coldwind.

The experts pointed out that SCC Control (NETGEAR Smart Control Center) is disabled by default, and must be manually enabled in the web UI (Security > Management Security > SCC Control). The researcher also published a PoC code that changes the password to “AlaMaKota1234.”

NETGEAR on the advisory page rated the issue with a CVSS score of 8.8 (High), while Coldwind assigned it a score of 9.8 because “network should be used even if the attacker is required to be on the same intranet to exploit the vulnerable system (e.g., the attacker can only exploit the vulnerability from inside a corporate network).”

The second vulnerability reported by the expert is an authentication hijacking issue.

“NETGEAR GS110TPV3 Smart Managed Pro Switch is vulnerable to authentication hijacking (for lack of a better term) that allows an attacker with the same IP as a logging in admin to hijack the session bootstrapping information, giving the attacker full admin access to the device web UI and resulting in a full compromise of the device.” reads the advisory published by the researcher.”The obvious limiting factor here is the requirement for the attacker to either have the same IP as the admin (foothold on the same machine with limited privileges, same source NAT IP, etc) or being able to spoof the IP with various low-level network shenanigans, as well winning a race condition with a 1-second window (pretty easy actually).”

The researcher also released a PoC exploit that will attempt to win the race and hijack session bootstrap information.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Netgear)

---