Netgear has fixed a high-severity vulnerability affecting multiple WiFi router models and advised customers to update their devices to the latest available firmware as soon as possible.
The flaw impacts multiple Wireless AC Nighthawk, Wireless AX Nighthawk (WiFi 6), and Wireless AC router models.
Although Netgear did not disclose any information about the component affected by this bug or its impact, it did say that it is a pre-authentication buffer overflow vulnerability.
The impact of a successful buffer overflow exploitation can range from crashes following denial of service to arbitrary code execution, if code execution is achieved during the attack.
Attackers can exploit this flaw in low-complexity attacks without requiring permissions or user interaction.
In a security advisory published on Wednesday, Netgear said it “strongly recommends that you download the latest firmware as soon as possible.”
The list of vulnerable routers and the patched firmware versions can be found in the table below.
| Vulnerable Netgear router | Patched firmware version |
| RAX40 | Firmware version 1.0.2.60 |
| RAX35 | Firmware version 1.0.2.60 |
| R6400v2 | Firmware version 1.0.4.122 |
| R6700v3 | Firmware version 1.0.4.122 |
| R6900P | Firmware version 1.3.3.152 |
| R7000P | Firmware version 1.3.3.152 |
| R7000P | Firmware version 1.0.11.136 |
| R7960P | Firmware version 1.4.4.94 |
| R8000P | Firmware version 1.4.4.94 |
How to update your router’s firmware
To download and install the latest firmware for your Netgear router, you have to go through the following steps:
- Visit NETGEAR Support.
- Start typing your model number in the search box, then select your model from the drop-down menu as soon as it appears.
- If you do not see a drop-down menu, ensure you entered your model number correctly or select a product category to browse for your product model.
- Click Downloads.
- Under Current Versions, select the first download whose title begins with Firmware Version.
- Click Release Notes.
- Follow the instructions in the firmware release notes to download and install the new firmware.
“The pre-authentication buffer overflow vulnerability remains if you do not complete all recommended steps,” Netgear also warned.
“NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notification.”
A Netgear spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today for more information.
On Wednesday, Netgear urged customers to patch a second vulnerability that can be exploited to trigger a denial of service state in attacks targeting Wireless AC Nighthawk and Wireless AX Nighthawk (WiFi 6) routers.
Earlier this year, Netgear also fixed a bad Orbi firmware update that prevented customers from accessing their devices’ admin consoles.