NETGEAR is aware of a security issue on some models of ProSAFE Gigabit Smart Managed Switches that can let an attacker permanently modify certain system variables. This vulnerability occurs when a remote attacker uses SNMP to access stored XSS on the web management interface. The only system variables that can be accessed and modified because of this vulnerability are system name, system location, and system contact. No other settings are vulnerable, and no network traffic or credentials are exposed.
This vulnerability affects the following products:
- GS724Tv3 and GS716Tv2 with firmware version 5.4.2.25 or earlier
- GS510TP with firmware version 5.4.2.25 or earlier
- GS108Tv2 and GS110TP with firmware version 5.4.2.25 or earlier
- GS748Tv4 with firmware version 5.4.2.25 or earlier
NETGEAR has released firmware updates that fix the system variable modification vulnerability for all affected products. NETGEAR strongly recommends that all affected users upgrade their firmware to version 5.04.2.27 or later as soon as possible.
To download the firmware release that fixes the vulnerability, click the link for your product below and follow the installation instructions in the release notes.
The potential for system variable modification remains if you do not upgrade your firmware as recommended in this notification. NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notification.
We appreciate and value having security concerns brought to our attention. NETGEAR constantly monitors for both known and unknown threats. Being pro-active rather than re-active to emerging security issues is fundamental for product support at NETGEAR.
It is NETGEAR's mission to be the innovative leader in connecting the world to the internet. To achieve this mission, we strive to earn and maintain the trust of those that use NETGEAR products for their connectivity.
To report a security vulnerability, visit https://bugcrowd.com/netgear.
If you are a NETGEAR customer with a security-related support concern, you can contact NETGEAR customer support at techsupport.security@netgear.com.
For all other issues, visit https://www.netgear.com/about/security/.
The security@netgear.com email address is no longer accepting messages and is no longer actively monitored.