Actiontec upgrade site certificate issues

I have automatic firmware upgrades disabled on my Actiontec MI424-WR, Rev C. I tried to go to upgrade.actiontec.com to look to see if there are any newer versions of the firmware (I currently have version 4.0.16.1.56.0.10.12.3) , but my browser (Google Chrome) gave the following warning:

"You attempted to reach upgrade.actiontec.com, but instead you actually reached a server identifying itself as *.securesites.net. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of upgrade.actiontec.com. You should not proceed."

I then tried to use wget to directly download the latest firmware at the URL given on the router's firmware page, https://upgrade.actiontec.com/MI424WR/MI424WR.rmt, and got this error:

"ERROR: cannot verify upgrade.actiontec.com's certificate, issued by `/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com':

Unable to locally verify the issuer's authority."

Does this mean that someone is redirecting update requests to a rogue site, or has actiontec re-arranged their servers, but not gotten proper certificates?

Accepted answers

annonymous009

Well, now the site is working, but it tells me that directory browsing is disabled, and to use a direct url. Why the router's update page tells you to go there, I don't know.

I know my pc's clock was correct, the only thing that's changed is a momentary power outage here caused the router to reboot, so maybe something got reset there. All my custom settings seem to be like I left them, though.

All comments

Hubrisnxs

http://www2.verizon.net/micro/fios_router_update/

I think you have the latest though, when I click on the link the firmware version is the same as yours.

@annonymous009 wrote:
I have automatic firmware upgrades disabled on my Actiontec MI424-WR, Rev C. I tried to go to upgrade.actiontec.com to look to see if there are any newer versions of the firmware (I currently have version 4.0.16.1.56.0.10.12.3) , but my browser (Google Chrome) gave the following warning:
"You attempted to reach upgrade.actiontec.com, but instead you actually reached a server identifying itself as *.securesites.net. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of upgrade.actiontec.com. You should not proceed."
I then tried to use wget to directly download the latest firmware at the URL given on the router's firmware page, https://upgrade.actiontec.com/MI424WR/MI424WR.rmt, and got this error:
"ERROR: cannot verify upgrade.actiontec.com's certificate, issued by `/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com':
Unable to locally verify the issuer's authority."
Does this mean that someone is redirecting update requests to a rogue site, or has actiontec re-arranged their servers, but not gotten proper certificates?

ocean25

@annonymous009 wrote:
I have automatic firmware upgrades disabled on my Actiontec MI424-WR, Rev C. I tried to go to upgrade.actiontec.com to look to see if there are any newer versions of the firmware (I currently have version 4.0.16.1.56.0.10.12.3) , but my browser (Google Chrome) gave the following warning:
"You attempted to reach upgrade.actiontec.com, but instead you actually reached a server identifying itself as *.securesites.net. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of upgrade.actiontec.com. You should not proceed."
I then tried to use wget to directly download the latest firmware at the URL given on the router's firmware page, https://upgrade.actiontec.com/MI424WR/MI424WR.rmt, and got this error:
"ERROR: cannot verify upgrade.actiontec.com's certificate, issued by `/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com':
Unable to locally verify the issuer's authority."
Does this mean that someone is redirecting update requests to a rogue site, or has actiontec re-arranged their servers, but not gotten proper certificates?

Did you try enabling auto firmware updates, then check. If updated you can revert back to

disabling them. I'd suggest a complete spyware and anti-virus run first. Good luck!

Hubrisnxs

A lot of time site certificates errors are due to your windows clock date and time. So as weird as it may sound double click on your clock and make sure its the right date year and time.

annonymous009

Well, now the site is working, but it tells me that directory browsing is disabled, and to use a direct url. Why the router's update page tells you to go there, I don't know.