http://seclists.org/fulldisclosure/2015/Oct/29

It's an authentication bypass. Vulnerabilities in router web servers are incredibly common. Never enable remote web administration on a router.

Says no fix as of yet. Surely a simple fix is to disable remote acess?

http://www.ispreview.co.uk/index.php/2015/10/hackers... has a list of some of the affected models.

I've got a VPN server running on our network in order to configure,administrate and access the network remotely so basically you've to create a secure tunnel with a certificate into the network first.

The only open ports are for the web servers and HTTPS NAS access (via proxy server).

I think it's more secure to do it that way rather than opening the Netgear router or any other device on the network to be configured by WAN admin access.

In reply to a post by Zadeks:

http://seclists.org/fulldisclosure/2015/Oct/29

It's an authentication bypass. Vulnerabilities in router web servers are incredibly common. Never enable remote web administration on a router.

Similar to the D-Link one then, unauthenticated access to WAN-side admin. I use remote admin only when I can firewall all addresses other that the one that needs access.

But still, there's no excuse for such vulnerabilities.

However, Mr Wu added that attackers would have to get access to the network first and then guess the admin password.

That sentence doesn't seem to be in the article? Was it in there and they've deleted it?

The article suggests the password is not needed as the vulnerability is you can access the router bypassing the security. If the password is needed then it is not a security flaw as such as they were just changing DNS settings which is something you can do if you have the password.

In reply to a post by ian72:

However, Mr Wu added that attackers would have to get access to the network first and then guess the admin password.

That sentence doesn't seem to be in the article? Was it in there and they've deleted it?

Yes, they've edited it. It now more closely reflects the information posted here.

after trying to login without the right credentials and failing, the attacker just needs to hit http://<ROUTER-IP>/BRS_netgear_success.html �multiple times�, and the router will roll over and grant access.