Security News > 2021 > March > This Netgear SOHO switch has 15 – count 'em! – vulns, which means you need to upgrade the firmware... now

Netgear has released a swathe of security and firmware updates for its JGS516PE Ethernet switch after researchers from NCC Group discovered 15 vulnerabilities in the device - including an unauthenticated remote code execution flaw.

The switch is vulnerable to nine high-severity vulns and a further five medium-rated ones, said NCC Group IT security consultant Manuel Ginés Rodriquez in a damning blog post about his findings.

On top of that was an active-by-default TFTP server running on the device which permitted the upload and execution of unsigned firmware updates, allowing anyone at all to upload potentially malicious updates to the switch even if they weren't aware of the RCE vuln.

The company has form for its product lines containing multiple severe vulnerabilities, as The Register found last year when Netgear decided it wouldn't update the firmware for a swathe of vulnerable small office/home office routers - even though researchers had published live proof-of-concept code for exploits targeting the 40 devices.

In the company's defence it has published firmware updates for the JGS516PE switch on its website.

The firm, whose good reputation has taken a bit of a bashing in recent years, also came under fire from customers last year after they discovered that its latest managed switches do not offer access to the full user interface unless you register them through the Netgear Cloud.

News URL

https://go.theregister.com/feed/www.theregister.com/2021/03/11/netgear_jgs516pe_switch_15_vulns/