CVE-2024-36792
📋 TL;DR
This vulnerability in Netgear WNR614 routers allows attackers to obtain the WPS PIN through implementation flaws in the Wi-Fi Protected Setup feature. Attackers within wireless range can exploit this to gain unauthorized access to the router's network. Users of Netgear WNR614 JNR1010V2 routers with vulnerable firmware are affected.
💻 Affected Systems
- Netgear WNR614 JNR1010V2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the wireless network, allowing attackers to intercept traffic, perform man-in-the-middle attacks, and potentially access connected devices.
Likely Case
Unauthorized network access leading to bandwidth theft, network reconnaissance, and potential lateral movement to connected devices.
If Mitigated
Limited impact if WPS is disabled and strong WPA2/WPA3 encryption is used with a complex passphrase.
🎯 Exploit Status
Attack requires proximity to wireless signal; tools like Reaver or Bully can automate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check Netgear support site for firmware updates, but this model may be end-of-life.
🔧 Temporary Workarounds
Disable WPS
allTurn off Wi-Fi Protected Setup in router administration interface
Use WPA2/WPA3 with strong passphrase
allEnable WPA2 or WPA3 encryption with a complex, random passphrase (minimum 12 characters)
🧯 If You Can't Patch
- Replace router with supported model that receives security updates
- Segment network: place vulnerable router behind firewall or in isolated network segment
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is N300-V1.1.0.54_1.0.1 and WPS is enabled, you are vulnerable.Check Version:
Login to router admin interface (typically 192.168.1.1 or 192.168.0.1) and check firmware version in settings.Verify Fix Applied:
Verify WPS is disabled in router settings and strong WPA2/WPA3 encryption is enabled.📡 Detection & Monitoring
Log Indicators:
- Multiple failed WPS connection attempts
- Unusual WPS PIN authentication events
Network Indicators:
- WPS brute-force traffic patterns
- Unexpected devices connecting via WPS
SIEM Query:
Not applicable for typical home router deployments