Netgear warns users to patch recently fixed WiFi router bug

Netgear has fixed a high-severity vulnerability affecting multiple WiFi router models and advised customers to update their devices to the latest available firmware as soon as possible.

The flaw affects many models of the Wireless AC Nighthawk, Wireless AX Nighthawk (WiFi 6) and Wireless AC routers.

Although Netgear did not disclose any information about the component affected by this bug or its impact, it said it was a pre-authentication buffer overflow vulnerability.

The impact of a successful buffer overflow exploit can range from denial-of-service crashes to arbitrary code execution if code execution is achieved during the attack.

Attackers can exploit this flaw in low-complexity attacks without requiring user permission or interaction.

In a security advisory published Wednesday, Netgear said it “strongly recommends that you download the latest firmware as soon as possible.”

The list of vulnerable routers and patched firmware versions can be found in the table below.

Router Firmware Version NetGear Router Patched Rax40 Rax40 Version 1.0.2.60 RAX35 Firmware Version 1.0.2.60 R6400V2 Firmware Version 1.0.4.122 R6700V3 Firmware Version Version 1.0.11. version 1.4.4.94 R8000P firmware version 1.4.4.94 How to update your router firmware

To download and install the latest firmware for your Netgear router, you need to go through the following steps:

Visit NETGEAR Support. Start typing your model number in the search box, then select your model from the drop-down menu once it appears. If you don’t see a drop down menu, make sure you entered the model number correctly or select a product category to browse for your product model. Click “Downloads”. Under Current Versions, select the first download whose title begins with Firmware Version. Click Release Notes. Follow the instructions in the firmware release notes to download and install the new firmware.

“The pre-authentication buffer overflow vulnerability remains if you do not complete all recommended steps,” Netgear also warned.

“NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notice.”

A Netgear spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today for more information.

On Wednesday, Netgear asked customers to patch a second vulnerability that could be exploited to cause a denial of service condition in attacks targeting Wireless AC Nighthawk and Wireless AX Nighthawk (WiFi 6) routers.

Earlier this year, Netgear also fixed a botched Orbi firmware update that prevented customers from accessing their devices’ admin consoles.