Security News > 2021 > September > Netgear fixes dangerous code execution bug in multiple routers
Netgear has fixed a high severity remote code execution vulnerability found in the Circle parental control service, which runs with root permissions on almost a dozen modern Small Offices/Home Offices Netgear routers.
While one would expect the attack vector exposed by Circle security flaw would be removed after the service is stopped, the Circle update daemon containing the bug is enabled by default and it can be exploited even if the service is disabled.
"The update process of the Circle Parental Control Service on various Netgear routers allows remote attackers with network access to gain RCE as root via a Man-in-the-Middle attack," GRIMM security researcher Adam Nichols explained.
From within the ISP, the attacker will be able to compromise any routers vulnerable to the Circle Parental Control Service vulnerability.
In June, Microsoft disclosed critical firmware vulnerabilities found in some Netgear routers that can let attackers breach corporate networks after successful exploitation.
Last year, GRIMM and VNPT ISC security researchers also independently discovered a zero-day bug in 79 Netgear router models allowing attackers to take control of vulnerable devices remotely.