This behavior allows an attacker to perform a man-in-the-middle attack and to mimic the position of the update server. An analysis of the firmware showed that the router uses the widely used program wget with the parameter –no-check-certificate when downloading the firmware image from the update server. The HTTP connection used is protected by TLS, but the certificate of the update server is not checked by the router. A firmware update includes release notes ( /r7000/ww/stringtable.dat), language files ( /r7000/ww/R7000-*-Language-table) and the firmware image itself ( /r7000/ww/R7000-V1.0.XXX.*.chk). The firmware is not signed cryptographically. If the installed version number is lower, the router assumes that a new firmware version is available and the firmware update is downloaded from the update server and installed on the router. First, the currently installed firmware version is compared with the version number in the file /r7000/ww/fileinfo.txt on the update server. The Netgear R7000 router firmware retrieves new firmware updates from the update server. „At NETGEAR, we turn ideas into innovative networking products that connect people, power businesses, and advance the way we live. Paul Gründlinger (FH OÖ Campus Hagenberg)ĭI Markus Zeilinger (FH OÖ Campus Hagenberg)ĭieter Vymazal BSc MSc (FH OÖ Campus Hagenberg)įlorian Fingerprint: F48B DFAD 1B38 442A 1686 920C BF29 14FA 4A71 ECE7 Florian Hehenberger BSc (FH OÖ Campus Hagenberg) Simon Birngruber BSc (FH OÖ Campus Hagenberg) IoT Lab, University of Applied Sciences Upper Austria, Campus Hagenberg Netgear Nighthawk R7000 WLAN-Router AC1900 Netgear Nighthawk Firmware Update Vulnerability This vulnerability affects both manual updates via the web interface and automatic firmware updates. Furthermore, if the update server can not be reached via HTTPS, the router will automatically fall back to an unencrypted FTP connection. This allows an attacker with access to the upstream network to assume a TLS man-in-the-middle position and thereby deliver compromised firmware updates to the router. The router Netgear Nighthawk R7000 does not validate Netgear’s TLS server certificate when performing a firmware update.

Netgear r6120 firmware update