It's time to update Netgear's Wi-Fi routers again. Netgear, a maker of home networking equipment, has released a security update for 35 different models of routers, Wi-Fi range extenders, and modem/router combinations to fix three flaws discovered by Immersive Labs, a British security firm. Distributed.

Two of the flaws in the Netgear routers allow attackers who already have access to the router's management interface to hack the router and change configuration settings. These new settings can be used to create a backdoor that gives hackers permanent remote access to the router's controls.

Once the hacker has control of the router, they can see and control where you go on the Internet and can often see what you are sending and receiving.

To be fair, just being able to access the administrative interface in the first place already means game over, but this is still a serious flaw that needs to be fixed.

Another Netgear router flaw allows someone on the local network to obtain the router's serial number by querying a specific "port," or network interface. 9]

Normally, this is not so bad, but as Immersive Labs researcher Kev Breen explained in a company blog post yesterday (December 2), "This serial number is used as part of the [administrative] password reset feature on most Netgear devices . and is used as part of the [administrative] password reset feature on most Netgear devices"

.

"This mechanism is intended to ensure that only those with physical access to the device can reset the password," Breen added.

"Armed with this information, any user on the network could brute force the password reset question."

This less serious attack requires access to the local network, which is not as difficult as it may seem for an attacker. Many home network Wi-Fi access passwords can be guessed or brute-forced. If malware sneaks into home computers, smartphones, game consoles, and smart devices through other means, the malware can also gain access to the local network.

How to update Netgear routers to the latest firmware varies by model. Most modern Netgear routers have automatic updates enabled by default, and you should make sure that feature is turned on.

For other models, you will need to access the management interface and manually check for updates. Many of the models affected by these defects also support the Netgear Nighthawk mobile app, which allows users to check and install router firmware from their smartphones.

For older models, go to the Netgear support website, enter the model number of the router (printed on a sticker on the device itself), go to the support page for that model, check for firmware updates, and download the firmware update to your Mac or PC by A more complex router update procedure may be required, which involves downloading the update file and uploading the file to the router via the management interface.

If you need to access the Netgear router's management panel, you can also use a web browserhttp://198.168.1.1にアクセスできます。一部のネットギアルータでは、http://routerlogin.com or http://routerlogin.net.

usually if you are on the router's local network. Typically, the Netgear router's management interface user name is "admin". It is much more important to make sure that the password for the administrative interface is changed from the default password.

The default password for most home Wi-Fi routers, whether made by Netgear or not, can be easily found online. If left in place, they become sitting ducks for hackers.

While in the router's administrative settings, go to the "Advanced" portion of the interface and look for "Advanced Settings." click on UPnP and make sure it is disabled.

Next, click on "Web Service Management" or "Remote Management" and disable it as well. Doing so removes two common attack paths that hackers often use to attack routers.

Below is a list of Netgear devices that need to be updated. The firmware version numbers listed are the versions that fix these flaws. The version number of the firmware your router is running is displayed in the upper right corner of the management interface.

Eighteen Netgear Wi-Fi routers, range extenders, and modem/router combinations are vulnerable to the first two flaws listed above that allow an attacker to change the router's configuration settings. (Both versions of the RAX120 may also be vulnerable to other Wi-Fi router flaws disclosed by another researcher this week.)

DSL modem routers

Wi-Fi range extenders

LTE modem routers

Orbi Wi-Fi Systems

Wi-Fi routers

17 Netgear Wi-Fi router models are vulnerable to the device serial number of the device.

Wi-Fi routers