Looks like Netgear has a problem

[coxhaus]

https://www.theregister.co.uk/2020/01/20/netgear_exposed_certificates/

 

[dosborne]

..... and for those who want a preview before clicking on a link with no other context ...

Netgear left in its router firmware key ingredients needed to intercept and tamper with secure connections to its equipment's web-based admin interfaces.

Specifically, valid, signed TLS certificates with private keys were embedded in the software, which was available to download for free by anyone, and also shipped with Netgear devices. This data can be used to create HTTPS certs that browsers trust, and can be used in miscreant-in-the-middle attacks to eavesdrop on and alter encrypted connections to the routers' built-in web-based control panel.