Hardcoded Credentials Vulnerability in Netgear RAX43 Routers

CVE-2021-20170

Summary

The Netgear RAX43 router models, specifically version 1.0.3.96, suffer from a vulnerability due to the use of hardcoded credentials. This issue allows unauthorized users to manipulate configuration backups through a password-protected zip file that contains a hardcoded password (RAX50w!a4udk). Although the settings are encrypted, users can extract, alter, and re-zip the configuration, enabling them to change critical router settings not meant for user manipulation. This flaw underscores the importance of robust security practices in router firmware to prevent unauthorized access and protect network integrity.

References