[DEinspanjer]

I can't tell if the response from NETGEAR is just sensationalized and they are actually working on firmware updates that will fix the flaw or at least allow firewalling or disabling the feature. I would hope they don't think that "it can't be fixed" is actually an acceptable long term answer.

[rednovae]

I have reported vulns to NetGear before. They don't have any sort of security department, nor a method to handle vulnerability reports.

I have no idea what the truth actually is, but my experience would lead me to believe worst case.

[MichaelGG]

I know it's illegal, but it'd be eye opening to worm these machines, then have them inject a banner sometimes, to alert the user. I suppose that's an ethics question overall. I know many exploits that can and are being used for financial gain. [1] The vendors respond very poorly (lying or getting angry at me). Companies and customers are at risk. But no one cares. Unless a major incident occurred...

1: One expensive (8 digit) system that was targeted at multi tenant setups used Java for the UI. Annoying but OK. But, how did the Java app determine your login privileges? Oh, easy! The app would download the root credentials for the system, use them to login to MySQL over the Internet, then "SELECT Permissions from user where...".

I met the developers and their response was " yes that's a known issue in the current version ". Ignoring that many users were stuck on that version for a long time. For bonus points, this system logged the root credentials to debug log, in the user's home directory. I'll let you guess if their updated version was vulnerable as all hell, too.

Edit: This was a major VoIP switch vendor (NexTone, now killed/bought by Genband IIRC), so exploits were easily turned into money. (Just route traffic on someone else's trunk for a bit.) Though I've dealt with other VoIP providers, ones that keep much more info (full end user info, CALEA module available) that had SQL injection-> root takeover on the login page. That puts end users at risk, too. Their response? " Our programmers are top notch C/C++ guys, they just aren't perfectly familiar with PHP... "