A firmware update NETGEAR recently released for the N300 series routers addresses two denial-of-service (DoS) vulnerabilities found by security researchers at Cisco’s Talos group.
Tracked as CVE-2019-5054, the first of the two bugs resides in the session handling functionality of the NETGEAR N300 (WNR2000v5) HTTP server.
“An HTTP request with an empty User-Agent string sent to a page requiring authentication can cause a null pointer dereference, resulting in the HTTP service crashing,” Talos explains.
To trigger the vulnerability, an unauthenticated attacker can send a specially crafted HTTP request, the security researchers have discovered.
The second DoS vulnerability is tracked as CVE-2019-5055 and resides in the Host Access Point Daemon (hostapd) on the N300 (WNR2000v5) wireless router.
Talos discovered that it is possible to cause a null pointer dereference and trigger a crash of the hostapd service via a SOAP request sent in an invalid sequence to the <WFAWLANConfig:1#PutMessage> service.
The vulnerability can be triggered by an unauthenticated attacker able to send a specially-crafted SOAP request, the researchers note.
Both of these vulnerabilities were discovered in the NETGEAR N300 WNR2000v5 firmware version 1.0.0.70.
NETGEAR has already released patches to address them and users are advised to update to WNR2000v5 firmware version 1.0.0.72.
Related: Flaws Affecting Top-Selling Netgear Routers Disclosed
Related: Netgear Patches Over 50 Flaws in Routers, Switches, NAS Devices
More from Ionut Arghire
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- Latitude Financial Services Data Breach Impacts 300,000 Customers
- US Government Warns Organizations of LockBit 3.0 Ransomware Attacks
- New ‘Trigona’ Ransomware Targets US, Europe, Australia
- New Espionage Group ‘YoroTrooper’ Targeting Entities in European, CIS Countries
- CISA Seeks Public Opinion on Cloud Application Security Guidance
Latest News
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- New York Man Arrested for Running BreachForums Cybercrime Website
- Huawei Has Replaced Thousands of US-Banned Parts With Chinese Versions: Founder
- Latitude Financial Services Data Breach Impacts 300,000 Customers
