Security News > 2020 > February > Netgear's routerlogin.com HTTPS cert snafu now has a live proof of concept

An infosec researcher has published a JavaScript-based proof of concept for the Netgear routerlogin.com vulnerability revealed at the end of January.

Through service workers, scripts that browsers run as background processes, Saleem Rashid reckons he can exploit Netgear routers to successfully compromise admin panel credentials.

As we reported in January, Netgear was bundling valid, signed TLS certificates along with private keys embedded in firmware that anyone could freely download. Working on the basis that routerlogin.com is easier to communicate to non-techie users instead of a unique IP address on the local subnet, Netgear included HTTPS certificates in its firmware so customers didn't get scared off as browsers unable to connect to the internet threw up error messages and warnings when they couldn't authenticate the HTTPS connection to routerlogin.com.

Netgear did not answer when The Register called for comment.

Netgear eventually sent through this statement: "We see zero risk to our customers. This proof of concept is in reference to a TLS Certificate disclosure that had already been addressed with a HotFix as well as the revoking of the HTTPS certificate, which means there is no viable case for an exploit."

News URL

https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/02/12/netgear_router_https_cert_poc/