bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

BSI warns of security hole in 60 Netgear models

Summary

In January 2017 the BSI warned of a hole in around 60 Netgear router models through which attackers could read out the password of the web interface. It could be exploited if password recovery was disabled and the attacker was on the same network or remote management was active. The BSI rated the risk at level 5 without clearly explaining what that means.

Ideas

  • Of all things, a disabled security function opened the hole.
  • Remote management makes local holes reachable from the internet.
  • Cable, VDSL and pure routers were affected alike.

Insights

  • Remote management disabled by default is effective protection against mass attacks.
  • Risk scales only help if their levels are explained understandably.

Facts

  • Around 60 Netgear models were affected.
  • Remote monitoring was disabled by default.

References

Critique

  • The report only names the models without an update, not a complete list of affected devices.

Recommendations

  • Leave routers’ remote management disabled and use a VPN if needed.
  • After BSI warnings, check the manufacturer’s advice for your specific model.
  • On devices without an update, enable password recovery, as Netgear advises as a workaround.

Read the original article

Search the Web Archive

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.

g · 2023

Cisco warns of security holes it will not patch

In January 2023 Cisco warned of critical holes in the small business routers RV016, RV042, RV042G and RV082, but announced that it would not deliver any more updates. Manipulated HTTP requests to the web interface could bypass authentication and gain root access (CVE-2023-20025). As the devices had reached end of life, Cisco only pointed to blocking ports 443 and 60443, although proof-of-concept code already existed.