Netgear has published a security advisory noting that a handful of popular router models made by Netgear are affected by a serious security vulnerability that could allow remote hackers to take control.
Twitter user "Acew0rm" discovered the security flaw and emailed Netgear about it back in August, according to ComputerWorld. There hasn't been a ton of documentation on the vulnerability in the time that's elapsed since then and it has seemingly gone ignored by Netgear, at least until now.
"Netgear has recently become aware of the security issue #582384 that allows unauthenticated web pages to pass form input directly to the command-line interface. A remote attacker can potentially inject arbitrary commands which are then executed by the system," Netgear said in the security advisory.
Netgear added that it is investigating the security flaw, which it confirmed might affect at least three models, those being the R8000 (Nighthawk x6), R7000 (Nighthawk AC1900), and R6400 (AC1750 Smart).
Carnegie Mellon University's Computer Emergency Response Team (CERT) said the code to exploit the vulnerability is out in the wild. By convincing a user to visit a website containing the malicious code, a hacker could exploit the flaw and execute arbitrary commands with root privileges.
"The CERT/CC is currently unaware of a practical solution to this problem... Exploiting this vulnerability is trivial. Users who have the option of doing so should strongly consider discontinuing use of affected devices until a fix is made available," CERT said.
Netgear will update its security advisory once it has more information.
