Researchers at Tenable have found six critical vulnerabilities in Netgear’s Nighthawk R6700 model, which could allow an attacker to take over the whole network if exploited.
These vulnerabilities are found in Nighthawk version 1.0.4.120 and remained unpatched even now. Users are advised to refer to Netgear’s security portal regularly for updates and apply if anything is made available. And if running on older versions of Nighthawk, it’s advised to switch to newer models.
Vulnerabilities in Nighthawk Router
Vulnerabilities in any specific device are often limited to that device only. But any irregularities found in internet routers can affect the whole network based on it, which is even more dangerous. And once such case is regarding Netgear’s Nighthawk R6700, a popular router model around the world.
Also Read- Popular Routers Are Having Bugs Even When Running in Latest Firmware
Nighthawk R6700 is advertised by Netgear as a gaming router, due to its powerful hardware, gaming-focused features, and parental control support. This dual-band WiFi router is a great home network connector, used by many around the world.
While it’s so popular, Netgear ignoring the vulnerabilities in it is intriguing. This is as per Tenable researchers, who found six critical vulnerabilities in Nighthawk R6700 v3 as below;
- CVE-2021-20173: A post-authentication command injection flaw in the update functionality of the device, making it susceptible to command injection.
- CVE-2021-20174: HTTP is used by default on all communications of the device’s web interface, risking username and password interception in cleartext form.
- CVE-2021-20175: SOAP Interface (port 5000) uses HTTP to communicate by default, risking username and password interception in cleartext form.
- CVE-2021-23147: Command execution as root without authentication via a UART port connection. Exploiting this flaw requires physical access to the device.
- CVE-2021-45732: Configuration manipulation via hardcoded encryption routines, allowing the changing of settings that are locked for reasons of security.
- CVE-2021-45077: All usernames and passwords for the device’s services are stored in plaintext form in the configuration file.
The above vulnerabilities are found in firmware version 1.0.4.120 of Nighthawk R6700 v3, which is still supported by Netgear. Older versions (v2 and v3) are still vulnerable. So if you’re using them, consider upgrading to a newer one. And for v3 models, you should wait for Netgear to release a patch for securing them.
