Netgear fixes RCE flaw in routers’ parental controls feature

Bug in third-party code offers salutary lessons around enterprise risk management, say researchers

UPDATED Multiple Netgear routers contained a third-party vulnerability that could lead to remote code execution (RCE) via Manipulator-in-the-Middle (MitM) attacks, security researchers have revealed.

Now patched, the vulnerability (CVE-2021-40847) was found in the update process for Circle, a third-party application that provides parental control features in the affected, small office/home office (SOHO) devices.

The Circle update daemon, circled, “connects to Circle and Netgear to obtain version information and updates” for its filtering database, infosec firm GRIMM explained in a blog post published on Tuesday (September 21).

However, database updates from Netgear were unsigned and downloaded via HTTP, which meant attackers could “respond to circled update requests with a specially-crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code.”

DNS-based MitM

Successful exploitation of the high-severity bug (CVSS 8.1) hinges on attackers being able to intercept and modify a vulnerable router’s network traffic.

But while the MitM “requirement does reduce the number of scenarios in which the vulnerability is exploitable, it doesn't change the impact of successful exploitation,” GRIMM told The Daily Swig.

The researchers outlined a DNS-based MitM attack that raced DNS queries from the Circle update daemon. These races are reliably won with GRIMM’s proof-of-concept (PoC) exploit, making code execution “trivial to obtain”, said GRIMM.

Other forms of MitM attacks could potentially work too, added the firm.

The researchers said compromised routers could also form “part of a larger chain to infiltrate more secure environments”.

This could involve compromising the internet service provider (ISP) via phishing, before compromising vulnerable Netgear routers as well as computers connected to the devices via a flaw such as the PrintNightmare vulnerability, suggested GRIMM.

Attackers could then pivot to the corporate network to “exfiltrate corporate data or launch further attacks”.

‘Attack surface reduction’

GRIMM also said the “vulnerability once again demonstrates the importance of attack surface reduction” given that the Circle update daemon, unlike the parental controls, is enabled by default.

“While it doesn’t fix the underlying issue, simply disabling the vulnerable code when Circle is not in use would have prevented exploitation on most devices,” reads the blog post.

Even though SOHO devices are designed for home offices or small businesses, the dramatic increase in home working due to the Covid-19 pandemic highlights a blind spot for enterprises, argued GRIMM.

“SOHO devices typically fly under the radar when it comes to cybersecurity risk management,” said the infosec firm, which recommends that enterprises use virtual private networks (VPNs) to mitigate SOHO risks.

GRIMM first attempted to notify the vendor of the flaw on July 23, making three attempts overall before notifying the US Cybersecurity and Infrastructure Security Agency (CISA) on August 9 and subsequently coordinating with Netgear.

The vendor released firmware upgrades on September 21. Affected models include R6400v2, R6700, R6700v3, R6900, R6900P, R7000, R7000P, R7850, R7900, R8000, and RS400.

Netgear has not responded to additional queries from The Daily Swig. We will update the story if and when it does.

This article was updated with a comment from GRIMM on September 24.