The current firmware release for the Netgear Nighthawk R6700v3 router contains a half-dozen high-risk weaknesses, according to specialists. The issues are still present at the time of publication. The Nighthawk R6700 is a renowned dual-bank WiFi router that boasts gaming-focused features, intelligent parental controls, and the underlying hardware that can handle the demands of home power users.

Tenable experts uncovered the six issues, which might permit an intruder on the network to take full control of the system:

• CVE-2021–20173: The device’s update mechanism has a post-authentication command injection weakness, rendering it vulnerable to command injection.
• CVE-2021–20174: HTTP is used by design for all web interface interactions, putting usernames and passwords at risk of being intercepted in plaintext form.
• CVE-2021–20175: The SOAP Interface (port 5000) communicates through HTTP by default, putting usernames and passwords at risk of being intercepted in plaintext form.
• CVE-2021–23147: Command execution as root over a UART port connection without authentication. Direct access to the device is required to leverage this issue.
• CVE-2021–45732: Hardcoded encryption methods enable configuration manipulation, permitting the modification of parameters that are blocked for security reasons.
• CVE-2021–45077: The configuration file stores all usernames and passwords for the device’s services in plaintext.

Tenable discovered multiple cases of jQuery libraries dependent on version 1.4.2, which is suspected to contain flaws, in addition to the above-mentioned security problems. The researchers also point out that the equipment makes use of a MiniDLNA server version that has been known to have issues.

The issues impact firmware version 1.0.4.120, which is the most recent version for the device. For stronger protection against malware intrusions, users should update the default passwords to something unique and strong and follow suggested security measures. Also, keep an eye on Netgear’s firmware update website for new releases and install them as soon as they’re published. It’s also a good idea to enable automatic updates on your network.

The latest security statement applies to the Netgear R6700 v3 model, which is still supported, rather than the Netgear R6700 v1 and R6700 v2 models, which are no longer supported. It is advised that you upgrade outdated models if you are still using them. Tenable notified the manufacturer of the aforementioned issues on September 30, 2021, and despite some information exchange in the form of additional details and recommendations, the issues remain unresolved.