Insights Security & Privacy
Netgear router and extender flaws fixed: check your firmware
The short version
Netgear has patched medium-severity flaws in several routers and range extenders. An attacker would need to be on your network first. Two older models get no fix at all, and others get no further updates.
What happened
Netgear's October security notice covers flaws in Nighthawk and Orbi routers and in two Wi-Fi range extenders, the devices that stretch a signal further. Each flaw could let someone already on your network run unauthorised commands, change settings or take over the admin page. One of them only applies if the Block Sites feature, which stops chosen websites loading, is switched on.
Fixed firmware, the software built into the device, is available for models such as the RAX30, RAX28, RAX29, RAXE300, CAX30 and EX6120.
Several models have reached end of support, so no more security updates are planned. The CBR40 and R7300DST get no fix at all. The RAX5, EX3700, R7000, R7000P and RAX40 got a final update.
Why it matters to you
Most of these flaws need the attacker to be on your Wi-Fi or to know the router's admin login, so the risk is lower than for flaws anyone on the internet could use. Still, anyone who has your Wi-Fi password is in a position to try.
A router controls everything on your network. If you use an unsupported model, no new fixes are planned, and Netgear recommends replacing it.
What to do
Find your router or extender model on its label, then check its firmware version in its settings page and update it to the latest. Netgear also offers downloads on its website. Turn on automatic updates if your device allows it.
If your model is listed as end of support, plan to replace it. Meanwhile, keep your Wi-Fi password private and use a strong admin password.
Sources
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.