Security News > 2021 > September > Critical Auth Bypass Bug Affect NETGEAR Smart Switches — Patch and PoC Released

Networking, storage and security solutions provider Netgear on Friday issued patches to address three security vulnerabilities affecting its smart switches that could be abused by an adversary to gain full control of a vulnerable device.

The flaws, which were discovered and reported to Netgear by Google security engineer Gynvael Coldwind, impact the following models -.

MS510TXM. MS510TXUP. According to Coldwind, the flaws concern an authentication bypass, an authentication hijacking, and a third as-yet-undisclosed vulnerability that could grant an attacker the ability to change the administrator password without actually having to know the previous password or hijack the session bootstrapping information, resulting in a full compromise of the device.

The three vulnerabilities have been given the codenames Demon's Cries, Draconian Fear, and Seventh Inferno.

"A funny bug related to authorization spawns from the fact that the password is obfuscated by being XORed with 'NtgrSmartSwitchRock," Coldwind said in a write-up explaining the authentication bypass.

In light of the critical nature of the vulnerabilities, companies relying on the aforementioned Netgear switches are recommended to upgrade to the latest version as soon as possible to mitigate any potential exploitation risk.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/fa-9UA-CNf4/critical-auth-bypass-bug-affect-netgear.html