CVE-2019-5016
📋 TL;DR
This vulnerability allows an unauthenticated attacker on the local network to read arbitrary kernel memory from affected routers by sending a specially crafted packet to the KCodes NetUSB.ko module. This can lead to denial of service or information disclosure. It affects NETGEAR Nighthawk routers and potentially other devices using the vulnerable KCodes NetUSB software.
💻 Affected Systems
- NETGEAR Nighthawk R7000
- NETGEAR Nighthawk R6400
- Other devices using KCodes NetUSB.ko module
📦 What is this software?
Netusb.ko by Kcodes
Netusb.ko by Kcodes
⚠️ Risk & Real-World Impact
Worst Case
Remote kernel memory disclosure leading to potential privilege escalation, complete system compromise, or persistent denial of service.
Likely Case
Denial of service (router crash/reboot) or sensitive kernel memory disclosure that could aid further attacks.
If Mitigated
Limited impact if device is isolated from untrusted networks and has updated firmware.
🎯 Exploit Status
Exploit requires sending crafted packets to port 20005/UDP. Public PoC available from Talos Intelligence.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NETGEAR firmware updates (check specific model)
Vendor Advisory: https://kb.netgear.com/000061457/Security-Advisory-for-Arbitrary-Memory-Read-Vulnerability-on-Some-Routers-PSV-2018-0504
Restart Required: Yes
Instructions:
1. Identify router model. 2. Visit NETGEAR support site. 3. Download latest firmware. 4. Upload via router admin interface. 5. Reboot router.
🔧 Temporary Workarounds
Disable ReadySHARE Printer
allTurn off the vulnerable NetUSB functionality in router settings
Block NetUSB Port
linuxBlock access to port 20005/UDP on router firewall
iptables -A INPUT -p udp --dport 20005 -j DROP
🧯 If You Can't Patch
- Segment network to isolate affected routers from untrusted devices
- Implement strict network access controls to limit who can communicate with router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check if port 20005/UDP is open and responding to NetUSB protocol. Use nmap: nmap -sU -p 20005 <router_ip>Check Version:
Log into router web interface and check firmware version in Administration or Advanced settingsVerify Fix Applied:
Verify port 20005/UDP is no longer open or responding. Check firmware version matches patched release.📡 Detection & Monitoring
Log Indicators:
- Router crash/reboot logs
- Kernel panic messages in system logs
- Unusual traffic to port 20005/UDP
Network Indicators:
- Malformed UDP packets to port 20005
- Excessive traffic to router on unusual ports
SIEM Query:
source_port=20005 OR dest_port=20005 protocol=UDP