Netgear Authentication Bypass Allows Router Takeover

[silversurfer]

Netgear has patched three bugs in one of its router families that, if exploited, can allow threat actors to bypass authentication to breach corporate networks and steal data and credentials.
 
Microsoft security researchers discovered the bugs in Netgear DGN-2200v1 series routers while they were researching device fingerprinting, Microsoft 365 Defender research team’s Jonathan Bar Or said in a blog post, posted Wednesday.
 
“We noticed a very odd behavior: A device owned by a non-IT personnel was trying to access a Netgear DGN-2200v1 router’s management port,” researchers wrote.
 
Researchers investigated and eventually identified the vulnerabilities, tracked as PSV-2020-0363, PSV-2020-0364 and PSV-2020-0365 by Netgear (CVEs were not issued), and which range in CVSS rating from high (7.4) to critical (9.4). They reported their discovery to Netgear, which has released a security advisory patching the flaws.
 
An attacker can exploit the flaws to breach a router’s management pages without having to log in, and take over the router, as well as use a cryptographic side-channel attack to acquire the router’s saved credentials, Bar wrote.
 
Full exploitation of the vulnerabilities “can compromise a network’s security — opening the gates for attackers to roam untethered through an entire organization,” he wrote.

Read more: Netgear Authentication Bypass Allows Router Takeover | Threatpost