CVE-2019-20679
📋 TL;DR
This vulnerability in NETGEAR MR1100 mobile routers allows attackers to bypass authentication and access administrative functions without credentials. It affects all MR1100 devices running firmware versions before 12.06.08.00. Attackers can exploit this to gain unauthorized control of the router.
💻 Affected Systems
- NETGEAR MR1100 (Nighthawk M1 Mobile Router)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attacker to change all settings, intercept network traffic, install malware, and use the device as a pivot point into the internal network.
Likely Case
Unauthorized access to router configuration, network settings modification, credential theft, and potential man-in-the-middle attacks.
If Mitigated
Limited impact if proper network segmentation and monitoring are in place, though router configuration could still be altered.
🎯 Exploit Status
The vulnerability is a simple authentication bypass that requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.06.08.00 or later
Vendor Advisory: https://kb.netgear.com/000061460/Security-Advisory-for-Missing-Function-Level-Access-Control-on-MR1100-PSV-2018-0537
Restart Required: Yes
Instructions:
1. Log into MR1100 web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates or manually upload firmware version 12.06.08.00 or later. 4. Apply update and wait for router to reboot.
🔧 Temporary Workarounds
Disable remote management
allPrevents external attackers from accessing the router's web interface
Network segmentation
allPlace MR1100 behind a firewall with strict access controls
🧯 If You Can't Patch
- Replace affected MR1100 devices with patched versions or alternative secure routers
- Implement strict network monitoring and alerting for unauthorized configuration changes
🔍 How to Verify
Check if Vulnerable:
Access router web interface and check firmware version in Advanced > Administration > Router StatusCheck Version:
No CLI command - check via web interface at Advanced > Administration > Router StatusVerify Fix Applied:
Confirm firmware version is 12.06.08.00 or later in router status page📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to admin pages
- Configuration changes from unexpected IP addresses
- Multiple failed login attempts followed by successful admin actions
Network Indicators:
- Unusual traffic patterns from router management interface
- HTTP requests to admin endpoints without authentication headers
SIEM Query:
source="mr1100-logs" AND (url="*/admin/*" OR url="*/cgi-bin/*") AND NOT user="admin"