Netgear and ZyXEL confirm NetUSB flaw, are working on fixes

The vulnerability could allow attackers to take over affected routers

Netgear Nighthawk AC1900 Smart WiFi Router

Netgear Nighthawk AC1900 Smart WiFi Router

Networking device manufacturers ZyXEL Communications and Netgear have confirmed that some of their routers are affected by a recently disclosed vulnerability in a USB device-sharing service called NetUSB.

ZyXEL will begin issuing firmware updates in June, while Netgear plans to start releasing patches in the third quarter of the year.

The vulnerability, tracked as CVE-2015-3036, is located in a Linux kernel module called NetUSB that's commonly used in routers and other embedded devices. The module is developed by a Taiwan-based company called KCodes Technology and allows routers to share USB devices with other computers via the Internet Protocol (IP).

Researchers from a company called Sec Consult found a buffer overflow vulnerability in the NetUSB service, which listens for connecting clients on TCP port 20005. The vulnerability can be exploited to execute malicious code on vulnerable devices with the highest possible privilege, leading to a complete compromise.

Based on firmware scans, the Sec Consult researchers believe that over 90 products from D-Link, Netgear, TP-Link, Trendnet and ZyXEL are likely vulnerable. Products from 21 other vendors might be affected as well.

Only TP-Link had begun to release patches by the time the vulnerability was publicly disclosed Tuesday, but many other manufacturers had received advanced notice through the CERT Coordination Center.

The vulnerability, which concerns the ReadySHARE feature in Netgear products, can only be exploited from inside the local area network, not remotely from the Internet, Netgear said in an emailed statement.

The company has not yet revealed the number of affected products or their names, but said that it plans to start releasing firmware updates in the third quarter of the year.

That's quite a long time for Netgear routers to remain vulnerable, considering that there is no workaround available. The NetUSB service can't be manually disabled on Netgear routers and the port it uses cannot be firewalled, the Sec Consult researchers said in a blog post.

Netgear said its customers should make sure that Wi-Fi security is turned on, which is the default setting on its routers and gateways. It also recommends that they change the default password for the router to prevent unauthorized devices from accessing their network.

That advice might be of little use to small businesses like bars or restaurants that might be using Netgear routers and need to share the Wi-Fi password with customers and guests.

Even on home networks, where access is more strictly controlled, if attackers compromise a computer that's inside the network -- for example, through malware -- they could use it to compromise the router from within.

Netgear advised users to scan their computers for malware regularly and to enable the firewall feature in their operating systems as a precaution.

ZyXEL has developed a fix for the vulnerability and is in the process of rebuilding the NetUSB modules, a company representative said Thursday via email.

The company has identified four affected products and estimates that patches for them will be released in June. The affected products have not been named, but the company is working on a public announcement about the issue.

The Sec Consult advisory names 38 products from Netgear, 39 from TP-Link, 14 from Trendnet, 4 four ZyXEL and 1 from D-Link that are likely vulnerable. However, the list is likely incomplete, the researchers said.

According to the advisory, TP-Link has already provided a release schedule and plans to release firmware updates for most of its affected products by the end of May. However, there are also five affected TP-Link routers that have reached end-of-life and will most likely not receive patches. That will probably also be the case with some affected devices from other manufacturers. Networking device manufacturers ZyXEL Communications and Netgear have confirmed that some of their routers are affected by a recently disclosed vulnerability in a USB device-sharing service called NetUSB.

ZyXEL will begin issuing firmware updates in June, while Netgear plans to start releasing patches in the third quarter of the year.

The vulnerability, tracked as CVE-2015-3036, is located in a Linux kernel module called NetUSB that's commonly used in routers and other embedded devices. The module is developed by a Taiwan-based company called KCodes Technology and allows routers to share USB devices with other computers via the Internet Protocol (IP).

Researchers from a company called Sec Consult found a buffer overflow vulnerability in the NetUSB service, which listens for connecting clients on TCP port 20005. The vulnerability can be exploited to execute malicious code on vulnerable devices with the highest possible privilege, leading to a complete compromise.

Based on firmware scans, the Sec Consult researchers believe that over 90 products from D-Link, Netgear, TP-Link, Trendnet and ZyXEL are likely vulnerable. Products from 21 other vendors might be affected as well.

Only TP-Link had begun to release patches by the time the vulnerability was publicly disclosed Tuesday, but many other manufacturers had received advanced notice through the CERT Coordination Center.

The vulnerability, which concerns the ReadySHARE feature in Netgear products, can only be exploited from inside the local area network, not remotely from the Internet, Netgear said in an emailed statement.

The company has not yet revealed the number of affected products or their names, but said that it plans to start releasing firmware updates in the third quarter of the year.

That's quite a long time for Netgear routers to remain vulnerable, considering that there is no workaround available. The NetUSB service can't be manually disabled on Netgear routers and the port it uses cannot be firewalled, the Sec Consult researchers said in a blog post.

Netgear said its customers should make sure that Wi-Fi security is turned on, which is the default setting on its routers and gateways. It also recommends that they change the default password for the router to prevent unauthorized devices from accessing their network.

That advice might be of little use to small businesses like bars or restaurants that might be using Netgear routers and need to share the Wi-Fi password with customers and guests.

Even on home networks, where access is more strictly controlled, if attackers compromise a computer that's inside the network -- for example, through malware -- they could use it to compromise the router from within.

Netgear advised users to scan their computers for malware regularly and to enable the firewall feature in their operating systems as a precaution.

ZyXEL has developed a fix for the vulnerability and is in the process of rebuilding the NetUSB modules, a company representative said Thursday via email.

The company has identified four affected products and estimates that patches for them will be released in June. The affected products have not been named, but the company is working on a public announcement about the issue.

The Sec Consult advisory names 38 products from Netgear, 39 from TP-Link, 14 from Trendnet, 4 four ZyXEL and 1 from D-Link that are likely vulnerable. However, the list is likely incomplete, the researchers said.

According to the advisory, TP-Link has already provided a release schedule and plans to release firmware updates for most of its affected products by the end of May. However, there are also five affected TP-Link routers that have reached end-of-life and will most likely not receive patches. That will probably also be the case with some affected devices from other manufacturers.

Join the CSO newsletter!

Error: Please check your email address.

Tags patchesintrusionsecurityTRENDnetnetgearZyXEL CommunicationsD-LinkExploits / vulnerabilitiesTP-Link

More about LinuxTechnologyTP-LinkZyXEL

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place