NETGEAR Access Point, Wireless Controllers, Smart Switches, Managed Switches and majority of ProSAFE Firewall do not use BASH shell that is vulnerable to this "shellshock" bug.
NETGEAR cloud services are not exposed to this bug.
NETGEAR ReadyNAS (OS versions 4.1.x, 4.2.x, 5.x, 6.x), ReadyDATA (OS version 1.x), FVS318N and ProSECURE UTM firewall do contain the BASH shell that is affected
NETGEAR is taking steps to prevent compromise by the "shellshock" bug.
As best practice, it is recommended not to create static port forwards on your internet gateway device to your ReadyNAS / ReadyDATA. This will limit your exposure to any threats or vulnerabilities.
Current status
| Product | Status | Notes | Last Updated |
| ReadyDATA | Update not required | All ReadyDATA attack vectors require authentication. The only CGIs used in ReadyDATA never directly execute any commands; | |
| ReadyNAS OS 6.x | Patched. Firmware version 6.2.0 released | Release note and download link available here. | 24th Nov, 2014 |
| ReadyNAS OS 4.2.x | Patched. Firmware version 4.2.27 released | Release note and download link available here. | 10th Nov, 2014 |
| ReadyNAS OS 4.1.x | Patched. Firmware version 4.1.14 released | Release note and download link available here. | 10th Nov, 2014 |
| ReadyNAS OS 5.x | Patched. Firmware version 5.3.11 released | Release note and download link available here here. | 10th Nov, 2014 |
| ProSECURE UTM firewall | Patched. Firmware version 3.6.1-38 released | Release note and download links available here. Note: You must have active maintenance license to upgrade | 7th Oct, 2014 |
| ProSAFE FVS318N | Patched. Firmware version 4.3.1-31 released | Release note and download link available here. | 10th Nov, 2014 |
Technical details of the shellshock bug:
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.