Security News > 2020 > January > Leaving your admin interface's TLS cert and private key in your router firmware in 2020? Just Netgear things

Netgear left in its router firmware key ingredients needed to intercept and tamper with secure connections to its equipment's web-based admin interfaces.

Specifically, valid, signed TLS certificates with private keys were embedded in the software, which was available to download for free by anyone, and also shipped with Netgear devices.

To cryptographically prove the cert is legit when a connection is established, the router needs to use the certificate's private key.

So either Netgear switches to using per-device private-public keys, or stores the private key in a secure HSM in the router, or just uses HTTP, or it has to come up with some other solution.

"The firmware images that contained these certificates along with their private keys were publicly available for download through Netgear's support website, without authentication; thus anyone in the world could have retrieved these keys."

News URL

https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/20/netgear_exposed_certificates/