Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More

By: John Scanlan, Published on Aug 26, 2019

Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered by prolific researcher bashis.

Most importantly, it shows supply chain risks with so many sharing the same fundamental software/hardware.

Inside, we report details on:

  • Vulnerability overview
  • Realtek response
  • Which manufacturers are affected
  • Why so many companies are vulnerable
  • Impact on the security industry
  • Supply chain risks

Those interested in cybersecurity within our industry should see our Cybersecurity Vulnerability Directory.

*****, ******* *** **** than * ***** ***** brands, ********* ***** ***** ones, **** **** ***** to ***** *** **** critical *************, ********** ** prolific ****************.

**** ***********, ** ***** supply ***** ***** **** so **** ******* *** same *********** ********/********.

******, ** ****** ******* on:

  • ************* ********
  • ******* ********
  • ***** ************* *** ********
  • *** ** **** ********* are **********
  • ****** ** *** ******** industry
  • ****** ***** *****

***** ********** ** ************* within *** ******** ****** see **************** ************* *********.

[***************]

Executive *******

Realtek Switch Controller

******* ************* *** *** the **** ******* ********* - ***************** ****** ********** *******. This ******** **** ******** that **** ****** *** which **** ** *** various ****** **** **** to ****** **** *************.

*********************

***** ****** **** *** included ******* *** ****** of ***** ********.

***** *** ******* *************** in *** *** ********* stack ********* ***** *********** remote **** *********, *** in *** ***** ** concept, ****** ** **** to *** *** ****** admin ***** ****** ** credentials.

No *** **** *******

**** **** ***********, ** 5 ******, ******* ******* no ******** *** *** for ****, ********* ******'* ******:

*************, ** ** ***, since *** ******* ******** in ***** ****, ** weren’t **** ** ******* any ********* ******** **** Realtek ********* ***** ******.

Manufacturers ********

******** ** ************ *** ********* ****** manufacturers:

Switch Manufacturers Affected by Vulnerable SDK

**** * ******** ** each ************'* ******** *** impacted ***** ** ** based ** *** *** of *** ******** ******* chip. *** *******, *********, **** *** *** series, **** ***** ***** business ****, ** **********. By ********, *** ***** 300 ****** ******** **** is *** *** *** Cisco's ********** ********.

*** ************* ** *** limited ** *** ****** manufacturers *****. ****** **** us **** *** ************* has **** ****** ** 18 ******* *** ***** are ***** ******* ** unconfirmed, ** **** ** likely **** **** ***** are **** ***** *** SDK, *** *** *** discovered.

Surveillance ******** ********

*********** ******* ************ ***** *** ** the ******** *********, ***** and *******, *** *** choices *** ***** ************ network ********.

Updated ****** ********

********* **** ******** ********* should ****** ********, ** it ** *********. *****, Netgear, *** ***** ************* have ******* ******** ****** the *************. ***** *** links ** *** ******* firmware *** *** *** largest *************:

***** *** **** ********:*****-**,*****-***,*****-**,*****-***,*****-**,*****-***,*****-**,*****-****,*****-**,*****-***,**-***-**

******* ****** ********:****** ******* **** ******,*********,**********,*********,********,*********,**********,*********,********

Supply ***** *****

**** **** ****** *** published ***** **** ** least * ***** ************* without ******* ********, ********* to ****.

*** **** ** *** vulnerability ******* * *********** risk, *** **** **** it *** ** ****** distributed *** ** **** to *** *** ******* brands ** *** **, underscores *** ********** *** dangers ** ********* ******** devices ** *** ***** code ******* ** **** hardware **********.

Comments (12)

Undisclosed #1

08/26/19 03:44pm

** ***** * *** ranking *** ****?

* ****** ** ***** require *** ****** ** exploit *** ** *** vulnerabilities, ************ ***** ******** are ******* *** ***** for ****** ********** ************.

bashis mcw

In reply to Undisclosed #1 | 08/26/19 07:32pm

************* * *** ***** more **** *** ********** devices ** *** ******** as ** *****...

***** ******* *.* ** the **** ********

***** ***** ******** *** Series ***** ******** ****** Code ********* ***************

*.* *** *** ******

***** ***** ******** *** Series ***** ******** ************** Bypass *************

*** *.* *** *** third

***** ***** ******** *** Series ***** ******** ******* Injection *************

Avatar

Jonathan de Chateau

In reply to bashis mcw | 08/27/19 08:54am

**** ***** ******* ** proven *************** ** ***** fit ** *** ***** items **** ********** ********, oh **** **'* *** chinese.

Undisclosed #1

In reply to Jonathan de Chateau | 08/27/19 09:32am

** **** **'* *** chinese

*** **** ** **** the ******* **** **********. The *************** *** ****** back ** * ******* chip *** ***. ******* is * ******* *******.

Avatar

Jonathan de Chateau

In reply to Undisclosed #1 | 08/27/19 11:26am

* **** *** ******* involvement. ** ***** *** that ****** ** ***** to ** ***** *** for, ***** ***** *******, a ******** ******** ******.

**'* ****** ** ** that * ***** ****** like ***** *** ** many ****** *************** *** is *** * ******** security ******.

John Honovich

IPVM | In reply to Undisclosed #1 | 08/27/19 11:26am

******* ** * ******* company

******* ** **** ******, *** ***, *** China, *** ***.

Avatar

Jonathan de Chateau

In reply to John Honovich | 08/27/19 11:40am

* ***** *********. *** are *****, **'* *** PRC.

*****, **** **** **** vulnerabilities ** ******** **** serious ******** ***'* *** think?It's * ******* **** and ******** *****, **** in ****.

** **** ** ***** a ** ******* **** it ****?

Undisclosed #1

In reply to John Honovich | 08/27/19 11:46am

******* ** ************* ** Taiwan, *** ***** ******* chips *** ******* ******** all **** ** ********* from * ***** ********.

Jonathan Strauss

In reply to Jonathan de Chateau | 08/27/19 02:48pm

**** ** ***** *************** look **** **** *** coming *** *** *** UI ***** ****** ** disabled ** ***** ****.

Undisclosed #3

In reply to Undisclosed #1 | 08/26/19 08:59pm

* ****** ** ***** require *** ****** ** exploit *** ** *** vulnerabilities, ************ ***** ******** are ******* *** ***** for ****** ********** ************.

**** ***** **** **** my ***** ****, ***...

**** ************* ******* ***** Small ******** *** ****** Smart ******** ******* ******** versions ***** ** *.*.*.* with *** *** ********** interface *******.The *** ********** ********* ** ******* *** **** **** *** ***** ** *******.

Undisclosed Manufacturer #2

08/26/19 04:35pm

*** ********:

*. *********** **** *** second ******* ******** ** Other. ** ***** * few ****** **** **** up **** ******?

*. *** ****** ******* Kevin *******:*****://***.********.***/**/*********/.**'* **** ******* *** over * ****** **** all *** ******** (** Cisco **** ** *******) have **** ****** **** with **** **** ** malware. ***** *** *** of *** ******** ******** of ********.

Undisclosed #4

08/27/19 03:49pm

Login to read this IPVM report.

Related Reports

Dahua Critical Cloud Vulnerabilities on May 12, 2020
Dahua has acknowledged a series of cloud vulnerabilities that researcher...
China Surveillance Vulnerabilities Being Used To Attack China, Says China on Apr 07, 2020
While China video surveillance vulnerabilities have been much debated in the...
BICSI For IP Video Surveillance Guide on Feb 11, 2020
Spend enough time around networks and eventually someone will mention BICSI,...
Milestone Presents XProtect On AWS on May 04, 2020
Milestone presented its XProtect on AWS offering at the April 2020 IPVM New...
Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see,...
SenseB4 Presents Cloud Network Device Monitoring on Jun 09, 2020
SenseB4 presented its cybersecurity and network health monitoring products at...
VSaaS 101 on Mar 25, 2020
Video Surveillance as a Service (VSaaS) is the common industry term for cloud...
Access Control ADA and Disability Laws Tutorial on Feb 17, 2020
Safe access control is paramount, especially for those with...
Access Credential Form Factor Tutorial on Feb 10, 2020
Deciding which access control credential to use and distribute, including...
Use Access Control Logs To Constrain Coronavirus on Apr 09, 2020
Access control users have included capabilities that are not commonly used...
LSP Presents 2nd Generation FP Power Supplies on Apr 29, 2020
Life Safety Power (LSP) presented its FP2 power supply in the April 2020 IPVM...
China DVR/NVR Backdoor Discovered, Huawei Refutes on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed...
NetApp Presents Hybrid Cloud Video Archive on May 11, 2020
NetApp presented its hybrid S3 cloud video archive at the April 2020 IPVM New...
Embedded Logix Thermal Temperature Detection System Examined on Apr 08, 2020
Embedded Logix has been producing thermal temperature measurement systems for...
Clinton Electronics Presents Axis Camera Equipped Public View Monitor on Apr 22, 2020
Clinton Electronics presented their Axis camera-equipped corridor mode M10PA...

Recent Reports

Genetec CEO Declares "We Don't Negotiate Payment With Patent Trolls" on Aug 11, 2020
Are patent trolls like terrorists? Genetec's CEO is coming out strongly...
Hanwha AI Analytics Camera Tested on Aug 11, 2020
Hanwha has released their Wisenet P AI camera, adding person and vehicle...
Alabama Schools Million Dollar Hikvision Fever Camera Deal on Aug 11, 2020
The Baldwin County, Alabama public schools purchased a $1 million, 144-camera...
Dahua Taunts Australian Government, Continues To Sell Illegal Fever Cameras on Aug 10, 2020
Dahua is effectively taunting the Australian government by continuing to sell...
HID Releases VertX Replacement Aero on Aug 10, 2020
HID is replacing two established and broadly supported types of access...
NDAA Compliant Video Surveillance Whitelist on Aug 10, 2020
This report aggregates video surveillance products that manufacturers have...
Telpo China Temperature Tablets Tested on Aug 10, 2020
The provider for overseas companies ranging from Canon Singapore to US'...
Dangerous Hikvision Fever Camera Showcased by Chilean City on Aug 07, 2020
Deploying a fever camera outdoors, in the rain, with no black body, is...
"Grand Slam" For Pelco's PE Firm, A Risk For Motorola on Aug 07, 2020
The word "Pelco" and "grand slam" have not been said together for many years....
FLIR Stock Falls, Admits 'Decelerating' Demand For Temperature Screening on Aug 07, 2020
Is the boom going to bust for temperature screening? FLIR disappointed...
VSaaS Will Hurt Integrators on Aug 06, 2020
VSaaS will hurt integrators, there is no question about that. How much...
Dogs For Coronavirus Screening Examined on Aug 06, 2020
While thermal temperature screening is the surveillance industry's most...
ADT Slides Back, Disappointing Results, Poor Commercial Performance on Aug 06, 2020
While ADT had an incredible start to the week, driven by the Google...
AHJ / Authority Having Jurisdiction Tutorial on Aug 06, 2020
One of the most powerful yet often underappreciated characters in all...
SIA Coaches Sellers on NDAA 889B Blacklist Workarounds on Aug 05, 2020
Last month SIA demanded that NDAA 899B "must be delayed". Now that they have...