Unpatchable Vulnerabilities Discovered in Netgear WNR614 Router

June 10, 2024

The Netgear WNR614 N300, a budget-friendly router popular among home users and small businesses, has been found to contain six vulnerabilities of differing severity levels. Despite the device reaching its end-of-life (EoL) status and hence no longer receiving support from Netgear, it remains in use in numerous settings due to its reliability, performance, and user-friendly nature.

The vulnerabilities were discovered by RedFox Security and include issues such as authentication bypass, weak password policy, storing passwords in plain text, and exposure of the Wi-Fi Protected Setup (WPS) PIN.

The first vulnerability, CVE-2024-36787, allows an attacker to bypass authentication and gain access to the administrative interface through unspecified vectors. This vulnerability poses a significant risk to network security and user data as it allows unauthorized access to the router's settings.

CVE-2024-36788 is a vulnerability that results from the router improperly setting the HTTPOnly flag for cookies. This vulnerability could be exploited by an attacker to intercept and access sensitive communications between the router and the devices connected to it.

The third vulnerability, CVE-2024-36789, allows attackers to create passwords that do not conform to proper security standards. It even allows a single character to be used as a password for the administrator account, which could lead to unauthorized access, network manipulation, and potential data exposure.

CVE-2024-36790 is a vulnerability where the router stores credentials in plain text, making it easy for an attacker to gain unauthorized access, manipulate the router, and expose sensitive data.

The fifth vulnerability, CVE-2024-36792, involves the implementation of the WPS Wi-Fi feature and allows attackers to gain access to the router's PIN, exposing the router to potential unauthorized access and manipulation.

The final vulnerability, CVE-2024-36795, involves insecure permissions that allow attackers to access URLs and directories embedded within the router's firmware, increasing the risk of unauthorized network access and control.

As the router has reached EoL, Netgear is not expected to release security updates for these vulnerabilities. If users cannot replace the device at this time, they are strongly advised to apply mitigations that could help prevent attacks. However, users that still rely on the Netgear WNR614 should consider replacing it with a model that is actively supported by its manufacturer and offers better security.

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.