Enterprise AV Home WiFi Mobile Wifi Support Shop Deals

Associated CVE IDs:

  • CVE-2020-24588
  • CVE-2020-26146
  • CVE-2020-24587

NETGEAR is aware of a set of industry-wide WiFi protocol security vulnerabilities known as Fragment and Forge. Exploiting these WiFi security vulnerabilities requires both of the following conditions:

  • Someone must know or obtain your WiFi password; and
  • Someone must have a device within physical proximity of your WiFi network that can intercept communications between your router and the devices on your WiFi network.

If exploited, these vulnerabilities can be used to withdraw data without your knowledge and can lead to other exploits. NETGEAR has released fixes for products in the following categories. Click the links to jump to the table of products with available firmware fixes:

Routers

Extenders

Cable Modem Routers

WiFi Access Points

Nighthawk WiFi Mesh Systems

Orbi WiFi Systems

Orbi Pro WiFi Systems

AirCard

NETGEAR is developing and testing additional firmware fixes, which we will release as they become available.

As soon as a firmware fix is available for your affected product, NETGEAR strongly recommends that you download and install the update. For more information about available updates, see the table of affected products in this advisory. Until a firmware fix is available, we recommend that you follow the workarounds listed in this advisory below.

To download the latest firmware for your NETGEAR product:

  1. Visit NETGEAR Support.
  2. Start typing your model number in the search box, then select your model from the drop-down menu as soon as it appears.
    If you do not see a drop-down menu, make sure that you entered your model number correctly, or select a product category to browse for your product model.
  3. Click Downloads.
  4. Under Current Versions, select the first download whose title begins with Firmware Version.
  5. Click Release Notes.
  6. Follow the instructions in the firmware release notes to download and install the new firmware.

For the following cable products, new firmware is released by your Internet service provider after NETGEAR releases it to them:

  • C6250
  • C6900
  • C7000
  • C7100V
  • CAX30
  • CAX80

To see the latest firmware version for your cable product, visit What’s the latest firmware version of my NETGEAR cable modem or modem router?.

To check your cable product’s current firmware version, follow the steps in this knowledge base article: How do I view the firmware version of my cable modem or modem router?.

NETGEAR will update this advisory when more information is available.

Routers
Model Fixed in Firmware Version Fix Status
AC2100 1.2.0.88 Production release available
AC2400 1.2.0.88 Production release available
AC2600 1.2.0.88 Production release available
LAX20 1.1.6.28 Production release available
R6020 1.0.0.52 Production release available
R6080 1.0.0.52 Production release available
R6120 1.0.0.80 Production release available
R6220 1.1.0.110 Production release available
R6230 1.1.0.110 Production release available
R6260 1.1.0.84 Production release available
R6330 1.1.0.84 Production release available
R6350 1.1.0.84 Production release available
R6400 1.0.1.72 Production release available
R6400v2 1.0.4.118 Production release available
R6700AX 1.0.3.92 Production release available
R6700v2 1.2.0.88 Production release available
R6700v3 1.0.4.118 Production release available
R6850 1.1.0.84 Production release available
R6900P 1.3.3.140 Production release available
R7000 1.0.11.126 Production release available
R7000P 1.3.3.140 Production release available
R7100LG 1.0.0.70 Production release available
R7850 1.0.5.74 Production release available
R7900 1.0.4.46 Production release available
R7900P 1.4.2.84 Production release available
R7960P 1.4.2.84 Production release available
R8000 1.0.4.74 Production release available
R8000P 1.4.2.84 Production release available
R8300 1.0.2.154 Production release available
R8500 1.0.2.154 Production release available
RAX10 1.0.3.92 Production release available
RAX120 1.2.1.22 Production release available
RAX120v2 1.2.1.22 Production release available
RAX15 1.0.3.96 Production release available
RAX20 1.0.3.96 Production release available
RAX200 1.0.4.120 Production release available
RAX35 1.0.4.102 Production release available
RAX35v2 1.0.3.96 Production release available
RAX38 1.0.4.102 Production release available
RAX38v2 1.0.3.96 Production release available
RAX40 1.0.4.102 Production release available
RAX40v2 1.0.3.96 Production release available
RAX42 1.0.3.96 Production release available
RAX43 1.0.3.96 Production release available
RAX45 1.0.3.96 Production release available
RAX50 1.0.3.96 Production release available
RAX70 1.0.3.92 Production release available
RAX75 1.0.4.120 Production release available
RAX78 1.0.3.92 Production release available
RAX80 1.0.4.120 Production release available
RS400 1.5.1.80 Production release available
XR1000 1.0.0.58 Production release available
XR300 1.0.3.68 Production release available

 

Extenders
Model Fixed in Firmware Version Fix Status
EAX14 1.0.2.30 Production release available
EAX15 1.0.2.30 Production release available
EAX18 1.0.0.58 Production release available
EAX20 1.0.0.58 Production release available
EAX80 1.0.1.68 Production release available
EX2700 1.0.1.66 Production release available
EX2800 1.0.1.74 Production release available
EX3110 1.0.1.74 Production release available
EX3700 1.0.0.90 Production release available
EX3800 1.0.0.90 Production release available
EX5000 1.0.1.74 Production release available
EX6100v2 1.0.1.106 Production release available
EX6110 1.0.1.74 Production release available
EX6120 1.0.0.64 Production release available
EX6130 1.0.0.44 Production release available
EX6150v2 1.0.1.106 Production release available
EX6200v2 1.0.1.86 Production release available
EX6250 1.0.0.146 Production release available
EX6250v2 1.0.2.30 Production release available
EX6400v2 1.0.0.146 Production release available
EX6400v3 1.0.2.30 Production release available
EX6410 1.0.0.146 Production release available
EX6410v2 1.0.2.30 Production release available
EX6420 1.0.0.146 Production release available
EX7000 1.0.1.104 Production release available
EX7300v2 1.0.0.146 Production release available
EX7320 1.0.0.146 Production release available
EX7500 1.0.0.74 Production release available
EX7700 1.0.0.222 Production release available
EX8000 1.0.1.238 Production release available
WN3000RPv2 1.0.0.88 Production release available
WN3000RPv3 1.0.2.96 Production release available
EX6250v2 1.0.2.30 Production release available
EX6400v3 1.0.2.30 Production release available
EX6410v2 1.0.2.30 Production release available

 

Cable Modem Routers
Model Fixed in Firmware Version Fix Status
C6250 1.02.06 Firmware released to Internet service providers
C6900 1.01.38 Firmware released to Internet service providers
C7000 1.01.37 Firmware released to Internet service providers
C7100V 2.01.49 Firmware released to Internet service providers
CAX30 1.4.10.4 Firmware released to Internet service providers
CAX80 2.1.3.5 Firmware released to Internet service providers

 

Wireless Access Points
Model Fixed in Firmware Version Fix Status
WAC505 9.5.2.4 Production release available
WAC510 9.5.2.4 Production release available
WAC540 9.5.2.4 Production release available
WAC564 9.5.2.4 Production release available
WAX202 1.0.4.0 Production release available
WAX204 1.0.2.0 Production release available
WAX206 1.0.3.0 Production release available
WAX214 2.1.1.2 Production release available
WAX218 2.1.1.2 Production release available
WAX610 9.5.2.5 Production release available
WAX610Y 9.5.2.5 Production release available
WAX620 9.5.2.5 Production release available
WAX630 9.5.2.5 Production release available

 

Nighthawk WiFi Mesh Systems
Model Fixed in Firmware Version Fix Status
MR60 1.0.6.116 Production release available
MR80 1.1.5.4 Production release available
MS60 1.0.6.116 Production release available
MS80 1.1.5.4 Production release available

 

Orbi WiFi Systems
Model Fixed in Firmware Version Fix Status
LBR20 2.6.5.2 Production release available
RBR10 2.7.3.22 Production release available
RBR20 2.7.3.22 Production release available
RBR350 4.4.0.10 Production release available
RBR40 2.7.3.22 Production release available
RBR50 2.7.3.22 Production release available
RBR50v2 2.7.3.22 Production release available
RBR750 4.6.3.7 Production release available
RBR850 4.6.3.9 Production release available
RBS10 2.7.3.22 Production release available
RBS20 2.7.3.22 Production release available
RBS350 4.4.0.10 Production release available
RBS40 2.7.3.22 Production release available
RBS40V 2.6.2.8 Production release available
RBS50 2.7.3.22 Production release available
RBS50v2 2.7.3.22 Production release available
RBS50Y 2.6.2.202_HOTFIX Hotfix release available
RBS50Yv2 2.6.2.202_HOTFIX Hotfix release available
RBS750 4.6.3.7 Production release available
RBS850 4.6.3.9 Production release available
RBW30 2.6.2.6 Production release available

 

Orbi Pro WiFi Systems
Model Fixed in Firmware Version Fix Status
SRC60 2.6.2.202_HOTFIX Hotfix release available
SRR60 2.6.2.202 Production release available
SRS60 2.6.2.202 Production release available
SXR30 3.2.33.110_HOTFIX Hotfix release available
SXR80 3.2.6.102_HOTFIX Hotfix release available
SXS30 3.2.33.110_HOTFIX Hotfix release available
SXS80 3.2.6.102_HOTFIX Hotfix release available

 

AirCard
Model Fixed in Firmware Version Fix Status
DC112A 1.0.0.60 Production release available

 

Security Hotfixes

Security hotfixes are fixes that are applied on top of existing, fully tested firmware. Releasing hotfixes allows NETGEAR to quickly update existing products and streamline the firmware verification process without going through full regression testing. These hotfixes are targeted at specific security issues and should have minimal effect on other areas of the product’s code. Therefore, we do not expect that installing the hotfix will affect the regular operation of your product. Although our pre-deployment testing process did not indicate that these hotfixes would affect device operability, because full regression testing is reserved for final production firmware fixes, we always encourage our users to monitor their devices closely after installing a firmware hotfix.

 

Workarounds

  • Do not share your WiFi password.
  • Use a strong WiFi password and change it regularly.
  • Monitor your WiFi network for unknown devices. If your product is supported by one of our apps, using the app is the easiest way to monitor your WiFi network:
    • Orbi products: NETGEAR Orbi app
    • NETGEAR WiFi routers: NETGEAR Nighthawk app
    • Some NETGEAR Business products: NETGEAR Insight app

 

Disclaimer

This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information in the document or materials linked from the document is at your own risk. NETGEAR reserves the right to change or update this document at any time. NETGEAR expects to update this document as new information becomes available.

The Fragment and Forge vulnerabilities remain if you do not complete all recommended steps. NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notification.

 

Acknowledgements

Mathy Vanhoef

 

Common Vulnerability Scoring System

Rating: Medium

Score: 5.9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

 

Best Practices for Updating Firmware

We recommend that you keep your NETGEAR devices up to date with the latest firmware. Firmware updates contain security fixes, bug fixes, and new features for your NETGEAR products.

If your product is supported by one of our apps, using the app is the easiest way to update your firmware:

  • Orbi products: NETGEAR Orbi app
  • NETGEAR WiFi routers: NETGEAR Nighthawk app
  • Some NETGEAR Business products: NETGEAR Insight app (firmware updates through the app are available only for Insight subscribers)

If your product is not supported by one of our apps, you can always update your firmware manually by following the instructions in your product’s user manual, firmware release notes, or product support page. For more information, see Where can I find information about my NETGEAR product?.

 

Contact

We appreciate and value having security concerns brought to our attention. NETGEAR constantly monitors for both known and unknown threats. Being pro-active rather than re-active to emerging security issues is fundamental for product support at NETGEAR.

It is NETGEAR's mission to be the innovative leader in connecting the world to the internet. To achieve this mission, we strive to earn and maintain the trust of those that use NETGEAR products for their connectivity.

To report a security vulnerability, visit https://bugcrowd.com/netgear.

If you are a NETGEAR customer with a security-related support concern, you can contact NETGEAR customer support at techsupport.security@netgear.com.

For all other issues, visit http://www.netgear.com/about/security/.

 

Revision History

2021-05-11: Published advisory

2021-05-13: Corrected table language

2021-05-14: Added WAX204

2021-05-20: Added R6400

2021-05-25: Added EX6250v2, EX6400v3, EX6410v2

2021-06-02:

  • Added hotfix language
  • Added RAX200, RAX75, RAX80
  • Added hotfixes for R7000, RAX200, RAX35v2, RAX38v2, RAX40v2, RAX42, RAX43, RAX45, RAX50, MR80, MS80

2021-06-25: Updated from hotfix to production release available: MR80, MS80

2021-07-28:

  • Added language pertaining to models listed that are a part of a kit
  • Added RBR20, RBS20, RBR40, RBS40, RBR50, RBS50, WAC505, WAC510, WAC540, WAC564, WAX610, WAX610Y, WAX620, WAX630
  • Added hotfixes for MR60, MS60

2021-07-29: Added RBR50v2, RBS50v2

2021-08-04:

  • Added SRR60, SRS60
  • Corrected listed firmware for WAX630

2021-08-12: Added hotfixes for RBS50Y, SRC60, SXR30, SXR80, SXS30, SXS80

2021-08-13:

  • Added DC112A, EX3700, EX3800, EX6120, EX6130, EX7000, EX7500, RBR10, RBR350, RBR750, RBR850, RBS10, RBS350, RBS40V, RBS750, RBS850, RBW30, LAX20, R6700v2, R6700v3, R6900P, R7000P, R7100LG, R7850, R8000, R8300, R8500, RAX15, RAX20, XR1000
  • Added hotfixes for RBS50Y, SRC60, SXR30, SXR80, SXS30, SXS80, RS400, XR300

 2021-08-25:

  • Added AC2100, AC2400, AC2600
  • Added hotfix for RBS50Yv2
  • Corrected listed firmware for R6700v2

2021-10-19: Added WAX206

2021-10-20:

  • Added EX2700, EX2800, EX3110, EX5000, EX6100v2, EX6110, EX6150v2, EX6200v2, EX6250, EX6400v2, EX6410, EX6420, EX7300v2, EX7320, EX7700, WN3000RPv2, WN3000RPv3, R6020, R6080, R6120, R6220, R6230, R6260, R6330, R6350, R6850, R7900, R7900P, R7960P, R8000P
  • Updated from hotfix to production release available: RS400

2021-11-11: Added WAX202

2021-12-1:

  • Added WAX214, WAX218, C6250, C6900, C7000, C7100V, CAX80, EX8000, LBR20, R6400v2, RAX35, RAX38, RAX40
  • Updated from hotfix to production release available: MR60, MS60, R7000, RAX35v2, RAX38v2, RAX40v2, RAX42, RAX43, RAX45, RAX50, XR300
Last Updated:07/07/2025 | Article ID: 000063666

This article applies to:

Recently Viewed Articles

    Read this article in another language:

    Read this article in another language:

    Our team is here to help!

    Phone
    Chat
    Email