Netgear fixes dangerous code execution bug in multiple routers

Netgear has fixed a high severity remote code execution (RCE) vulnerability found in the Circle parental control service, which runs with root permissions on almost a dozen modern Small Offices/Home Offices (SOHO) Netgear routers.

While one would expect the attack vector exposed by Circle security flaw (tracked as CVE-2021-40847) would be removed after the service is stopped, the Circle update daemon containing the bug is enabled by default and it can be exploited even if the service is disabled.

"The update process of the Circle Parental Control Service on various Netgear routers allows remote attackers with network access to gain RCE as root via a Man-in-the-Middle (MitM) attack," GRIMM security researcher Adam Nichols explained.

"While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by default."

Successfully exploiting this vulnerability requires the attackers to modify network traffic or intercept traffic while on the same network to gain RCE as root on the targeted router.

After gaining root access, the attacker can take complete control of the network traffic passing through the compromised router allowing for reading encrypted data exchanged with other devices, including those on the victim's corporate network.

Nichols also shared a potential chain of attack threat actors can use to breach an enterprise network after compromising one of its employee's Netgear routers:

How to update your router's firmware

In a security advisory published on Monday, Netgear urged customers to download the latest firmware for their devices as soon as possible.

The complete list of Netgear routers vulnerable to CVE-2021-40847 exploits and patched firmware versions are listed below.

To download and install the latest firmware for your Netgear device, you have to follow this procedure:

Visit NETGEAR Support. Start typing your model number in the search box, then select your model from the drop-down menu as soon as it appears.
If you do not see a drop-down menu, make sure that you entered your model number correctly, or select a product category to browse for your product model. Click Downloads. Under Current Versions, select the first download whose title begins with Firmware Version. Click Release Notes. Follow the instructions in the firmware release notes to download and install the new firmware.

If you cannot immediately install these firmware updates, you can also use Nichols' mitigation advice.

"To mitigate the risks to corporate environments posed by vulnerable SOHO routers, GRIMM recommends the provisioning and use of Virtual Private Network (VPN) clients," the researcher said.

"These clients should be configured to handle all traffic to ensure that an attacker cannot read or modify network traffic in a way that cannot be detected by the VPN endpoints."

Earlier this month, Netgear fixed three severe security vulnerabilities dubbed Demon's Cries, Draconian Fear, and Seventh Inferno, impacting over a dozen of its smart switches, allowing threat actors to bypass authentication and take over unpatched devices.

In June, Microsoft disclosed critical firmware vulnerabilities found in some Netgear routers that can let attackers breach corporate networks after successful exploitation.

Last year, GRIMM and VNPT ISC security researchers also independently discovered a zero-day bug in 79 Netgear router models allowing attackers to take control of vulnerable devices remotely.