PT-2021-4799 · NetGear · Netgear R7000+9

Published 2021-09-20 · Updated 2021-10-07 · CVE-2021-40847

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR R6400v2 version 1.0.4.106 NETGEAR R6700 version 1.0.2.16 NETGEAR R6700v3 version 1.0.4.106 NETGEAR R6900 version 1.0.2.16 NETGEAR R6900P version 1.3.2.134 NETGEAR R7000 version 1.0.11.123 NETGEAR R7000P version 1.3.2.134 NETGEAR R7850 version 1.0.5.68 NETGEAR R7900 version 1.0.4.38 NETGEAR R8000 version 1.0.4.68 NETGEAR RS400 version 1.5.0.68

Description The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a Man-in-the-Middle (MitM) attack. The Circle update daemon, circled, is enabled by default and connects to Circle and NETGEAR to obtain version information and updates. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP, allowing an attacker to respond to circled update requests with a crafted, compressed database file. This enables the attacker to overwrite executable files with attacker-controlled code.

Recommendations To resolve the issue for each affected version, update the firmware to the latest version available on the NETGEAR technical support website. As a temporary workaround, consider disabling the circled daemon until a patch is available. Restrict access to the vulnerable circled daemon to minimize the risk of exploitation. Avoid using the circled daemon in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2021-05524

CVE-2021-40847

Affected Products

Netgear R6400V2

Netgear R6700

Netgear R6700V3

Netgear R6900P

Netgear R7000

Netgear R7000P

Netgear R7850

Netgear R7900

Netgear R8000

Netgear Rs400

References · 12

• 🔥 https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-40847 · Vendor Advisory
• https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40847 · Security Note
• https://bdu.fstec.ru/vul/2021-05524 · Security Note
• https://t.me/cibsecurity/29199 · Telegram Post
• https://t.me/ckure/9464 · Telegram Post
• https://securitylab.ru/vulnerability/524891.php · Note
• https://t.me/cybersecuritytechnologies/4359 · Telegram Post
• https://t.me/tomhunter/294 · Telegram Post
• https://t.me/true_secator/2132 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021092208 · Note