Two leading Netgear routers are vulnerable to a severe security flaw.
An advisory posted on Friday
in Carnegie Mellon University's public vulnerability database (CERT) said that Netgear's R7000
routers, running current and recent firmware respectively, are vulnerable to an arbitrary command injection flaw.
If exploited, the vulnerability could let an unauthenticated attacker run commands with root privileges.
The code to exploit the vulnerability -- effectively just a URL -- has been released publicly
, allowing anyone to carry out attacks.
An attacker would have to trick a user into visiting a website that contains the code, such as an invisible web frame, to exploit the flaw. Adding commands to the router's IP address can open up ports on the router, such as Telnet.
The advisory said that other router models may be vulnerable.