Due to the impact of the ongoing COVID-19 crisis today, many companies and organizations in the Philippines are already considering telecommuting or most commonly known as work-from-home as an alternate option to continue their day to day business operations. This makes work-from-home employees more vulnerable to attacks, as home routers were typically installed with its default settings and without additional security appliance, which may pose a threat to their organization

Multiple Netgear router models, some of which are used as home routers, have been identified to contain vulnerabilities that may be exploited by remote attackers to take control of an affected device. Seventy-nine (79) Netgear devices have been discovered to be affected and some of which have reached end-of-life (EOL) as follows:

___________________________________

A. Nature of Attack

What are the affected systems of this vulnerability:

Netgear Routers:

___________________________________

B. Actions to be Taken

CERT-PH encourage router owners to check and keep their devices updated to its latest version and if possible, replace EOL devices as manufacturers will not likely provide any further support and updates to accomodate its users. In addition, work-from-home employees must know the importance of home router security and improve their cybersecurity. As such, CERT-PH also recommends:

• Use a strong and unique WiFi password.
• Check connected devices to the router and make sure that there are no unrecognized device on the list, if there are, immediately disconnect the said device.
• Configure the router to hide the WiFi’s SSID to others, making it undetectable.
• Do not share WiFi’s password to visitors, and if not applicable, configure a guest networking for others to connect to.
• Periodically monitor router’s activity logs to check any odd or irregular actions.
• If an unknown or unauthorized activity was discovered, immediately change the passwords of the router’s admin account and password for the WiFi, change the WiFi’s SSID and turn off SSID broadcast, block the unknown device, and conduct further investigation and monitoring.