Netgear critical vulns come amid global netsec concern

Netgear is advising customers to upgrade their firmware after it patched two critical vulnerabilities affecting multiple routers. The networking biz didn't reveal too much in the way of details for either vulnerability, including whether they had been exploited or not, but warned that if customers didn't follow the recommended steps their products would remain vulnerable. Netgear didn't release CVE identifiers for the vulnerabilities, opting instead for its own product security vulnerability (PSV) IDs: 2024-0117 and 2023-0039. The authentication bypass bug (2024-0117) scored 9.6 using the CVSSv3 framework while the unauthenticated remote code execution (RCE) flaw scored 9.8. The at-risk wireless AP models include two that have reached end of life (EOL): WAX206 and WAX220, as well as the WAX214v2 which is still supported with updates. We wouldn't want to speculate on what circumstances customers could find themselves in if either vulnerability were exploited without Netgear's input, but the severity of the flaws and the fact updates are being released even for EOL products are telling. All of the routers vulnerable to RCE are part of Netgear's Nighthawk gaming range and are still supported by product updates: XR100, XR1000v2, and XR500. Netgear's advisories were published over the weekend, but this week a whole host of national security and cybersecurity agencies in the US, UK, Canada, Australia, Czechia, Japan, and more, issued or co-signed guidance on securing edge devices. ...