Netgear routers found to have critical vulnerabilities within the shipped software components.

[hggomes]

I have been a Netgear tester of several router models for years now.

The Netgear hardware is generally solid and reliable, however its the software side, in my opinion lacks attention in several key areas.

This is a totally unexpected problem, especially with the security issues being rampant today with consumer models by different companies, Netgear should look at their direct competitor ASUS with regular and persistent security updates fixes on their software networking devices.

I for one would have expected Netgear to use this fact in their favor, but instead in the end there I find more of the same sloppy and lazy implementations of the software components, this even within your current hardware on market today.

After checking the most recent GPL code for the latest high-end Netgear X8 R8500 router model (costing $400/550€), much to my surprise, I still see the same issues, something not acceptable:

OpenSSL 0.9.7f 22 March 2005 (software with 11 years and 2 months old)

OpenSSL: https://www.openssl.org/news/vulnerabilities.html

Sources:

http://www.downloads.netgear.com/files/GPL/R8500-GPL_V1.0.2.54_1.0.56.zip

All Netgear routers share the same components, this seems to me a critical issue for all your current products which we as consumers buy from a well established and trusted company such as Netgear...

So my questions to Netgear are:

Where is the software development oversight?
Where is the quality control?
Where is the the customer care?

As a Netgear user I would feel betrayed and that ultimately all Netgear cares is bottom lines and not building a more reliable trust base with their customers for something that, is in essence a cost of 60 seconds per most components in order to correct some of these issues.


https://community.netgear.com/t5/Ge...-critical-vulnerabilities-within/td-p/1085599


Best regards,
Hugo

 

[microchip]

One of the many reasons why I no longer will be getting Netgear stuff, not even if you pay me to do so...

 

[hggomes]

Some people have the same opinion but they end up buying them exclusively to use 3rd party FWs, otherwise based on original Netgear FWs i doubt anyone would even consider it a choise, unless they are not aware off the situation.

Unfortunately this is not an isolated case, the exact same thing also apply's to TP-Link devices, but at least here you can say "You pay what you get" (very cheap), which is not Netgear case, but not acceptable in any case.

 

[AntonK]

I have been a Netgear tester of several router models for years now.

The Netgear hardware is generally solid and reliable, however its the software side, in my opinion lacks attention in several key areas.

This is a totally unexpected problem, especially with the security issues being rampant today with consumer models by different companies, Netgear should look at their direct competitor ASUS with regular and persistent security updates fixes on their software networking devices.

I for one would have expected Netgear to use this fact in their favor, but instead in the end there I find more of the same sloppy and lazy implementations of the software components, this even within your current hardware on market today.

After checking the most recent GPL code for the latest Netgear X8 R8500 router model, much to my surprise, I still see the same issues, something not acceptable:

OpenSSL 0.9.7f 22 March 2005 (software with 11 years and 2 months old)

OpenSSL: https://www.openssl.org/news/vulnerabilities.html

Sources:

http://www.downloads.netgear.com/files/GPL/R8500-GPL_V1.0.2.54_1.0.56.zip

All Netgear routers share the same components, this seems to me a critical issue for all your current products which we as consumers buy from a well established and trusted company such as Netgear...

So my questions to Netgear are:

Where is the software development oversight?
Where is the quality control?
Where is the the customer care?

As a Netgear user I would feel betrayed and that ultimately all Netgear cares is bottom lines and not building a more reliable trust base with their customers for something that, is in essence a cost of 60 seconds per most components in order to correct some of these issues.


https://community.netgear.com/t5/Ge...-critical-vulnerabilities-within/td-p/1085599


Best regards,
Hugo

You pose important questions, and a related thread can be found here: http://www.snbforums.com/threads/r7000-firmware-questions.31061/

This board's Netgear representative has been unable to get a response from Netgear engineering for months. It's a disgrace that we're using firmware that does not have the latest patches.

 

[hggomes]

Unfortunately in these cases company's end up learning the wrong way, and the best way for users delivering that message is not purchasing their products anymore until they start listening clients and step up forward solving their own mess up.

 

[Sachb]

Netgear's new Genie is simple but has no Features and the Functionality that an Asus or any other Router brand provides. And fyi, I have a Netgear EX6120 Extender which Doesn't show my ASUS router while its on channel >48. Anything above 48 and my ASUS router is not seen by the extender.

How Odd? So I'm Forced to use channel 48 or below. Someone suggested using upper channels for 5 GHZ for Better range but in my case i'm unable to do so. What a poor implementation on a Good and reputed Brand and Model.

 

[microchip]

Some people have the same opinion but they end up buying them exclusively to use 3rd party FWs, otherwise based on original Netgear FWs i doubt anyone would even consider it a choise, unless they are not aware off the situation.

That's exactly how I chose Netgear this time. I wasn't aware at all about their FW suckage and I just got native IPv6 at home so I needed a new toy to play with it (also a replacement for my old TP-Link router). I went for Netgear, banged my head many times and went forth and back with their support but in the end nothing could be or was done. Since I couldn't send it back anymore, I loaded XVortex on it and am still happy with it.

Decent HW, really horrible FW. All I hear from Netgear Guy is that he passes it to engineering but they never do a thing. It's like these guys dismiss most of the issues and do nothing about them

 

[NETGEAR Guy]

Hi..

Understand your frustrations...issues/feedback get passed on to the right teams who are aware there are outstanding issues to resolve.

Apologies for the late updates...

 

[thiggins]

FYI: The new Router test process will include checks for heartbleed and deprecated SSL protocols.

 

[RogerSC]

I'm one of those that doesn't buy Netgear routers for their firmware *smile*. Even if it didn't have security vulnerabilities, the firmware's web admin interface drives me up the wall. Little useful or information of interest available. Not even a full syslog-type log, just a dumbed down log with very little of value in it. Even the list of attached devices is not helpful, and there's no consolidated list of the dhcp addresses that have been doled out with the devices that they were assigned to. There's so much more that I want to know about what's going on in my network from the point of view of my router that I use Netgear firmware as little as possible. I'm sure that's why Netgear has supported third-party firmware, so that those that want a more useful admin interface can get it.

 

[System Error Message]

Netgear's hardware as always been good but not their firmware. This trait also extends to their other products such as switches.