If you care about the security of your router, and you should, it is best to avoid consumer grade routers. On the whole, the software in these routers is buggy as heck. Below is what I base this opinion on.

This page documents the existence of bugs in routers. Starting April 2018, I also track routers in the news which details the exploitation of router flaws.

You may be thinking that all software is buggy, but router software is probably worse. One reason for this is your ISP, which may have configured the router/gateway in an insecure way, either on purpose, to allow spying, or out of laziness or incompetence. Another reason is cost: router software is developed as cheaply as possible.

BIG BUGS: A number of flaws stand out. The port 32764 issue from January 2014 and April 2014 for example. A router backdoor was exposed, then instead of being removed, was just better hidden. Another flaw not to be missed is the Misfortune Cookie from December 2014. Then, of course, there is WPS, the electronic equivalent of a "hack me" sign on your back. Other huge flaws involved UPnP being exposed to the Internet and file sharing on a USB port.

THE US GOVERNMENT: In January 2017, the FTC accused D-Link of leaving its routers and webcam devices vulnerable to hackers. A lawsuit alleged that D-Link "failed to take reasonable steps to protect their routers and IP cameras from widely known and reasonably foreseeable risks of unauthorized access." D-Link was also accused of misleading the public about the security of their devices. D-Link denied they did anything bad. More on the Router News page.

This page has bugs from 2023, 2022, 2021, 2020 and 2019. Older bugs, from 2018 through 2012, are available at the bottom of this page. To see all the bugs on one B_I_G web page (makes it easy to find all the issues for any one manufacturer) click this button ==>

2024

DECEMBER 2024

Six buggy Asus routers say bad things about Asus

ASUS Router Improper Input Validation by Asus   December 3, 2024
Six Asus routers are buggy the RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX57, RT-AX58U and RT-AX58U_V2. Ho hum, but ... the bug is improper input validation - again. The context here is that just last month (Nov. 2024) Asus issued bug fixes for many of their routers, and one of the bugs they fixed was improper input validation. For exmaple, the AX55, AX57 and AX58 all had new firmware issued just last month. It seems that Asus did a poor job fixing their bugs. Not to mention the large number of bugs they fixed in June 2024, not all that long ago. This time, there is just one bug being fixed, CVE-2024-11985. Last month, Asus danced around the issue of how many bugs they were fixing.

Zyxel bugs: pros and cons

Zyxel security advisory for buffer overflow and post-authentication command injection vulnerabilities in some 4G LTE/5G NR CPE, DSL/Ethernet CPE, fiber ONTs, and WiFi extenders
by Zyxel   December 3, 2024
There are three bugs in Zyxel software. Yawn. The bugs affect many different types of Zyxel devices. There are fixes. Yawn. What impresses me, however, is how thorough the company was in researching these bugs. Their writeup has three long lists of vulnerable devices, one for each bug. Typically a bug is reported in one device, that device is fixed and 99 other devices that probably have the same bug are ignored. Not here. The down side, however, is getting the patched software. Zyxel says "For end-users who purchased your Zyxel device yourself, please contact your local Zyxel support team for the new firmware file to ensure optimal protection, or visit Zyxel's Community for further assistance." They link to community.zyxel.com/en which is a generic support site with nothing specific about firmware downloads.

NOVEMBER 2024

Still more critical D-Link router bugs

D-Link tells users to trash old VPN routers over bug too dangerous to identify
by Connor Jones of The Register   November 20, 2024
This sure looks like the story below from November 13th, but no. This too is a serious remote code execution (RCE) vulnerability. Here too, the routers are too old to bother fixing and should be replaced. But this is different: "Most of the details about the bug are being kept under wraps given the potential for wide exploitation. Unauthenticated RCE issues are essentially as bad as vulnerabilities get ..." D-Link is offering 20 percent off the price of a new D-Link router. Not a good move, best to avoid D-Link. These routers are vulnerable to this bug and went EoL in May 2024: DSR-150, DSR-150N, DSR-250, DSR-250N. These routers are also vulnerable to this bug, but they went EoL 9 years ago: DSR-500N and DSR-1000N.

• DSR-150/DSR-150N/DSR-250/DSR-250N/DSR-500N/DSR-1000N: - End-of-Life / End-of-Service in North America from D-Lnk. Last updated November 26. Weasels: "When a product reaches the end of its support or lifecycle , which we have always announced in advance, further extended support, updates, or development may not be available." May not? How about definitely will not. And, how do they announce it? They don't say. Probably just a web page somewhere. They probably don't email owners of the devices. Does the router web interface warn that the product is EoL? If they did these things, they would probably say so.

Fortinet fails to fix buggy Windows VPN software

Chinese hackers exploit Fortinet VPN zero-day to steal credentials
by Bill Toulas of Bleeping Computer   November 18, 2024
There is a bug in the Fortinet Windows VPN client software that allows bad guys to steal credentials after the victim has authenticated to the VPN server. A new report from Volexity says that they discovered and reported the bug earlier this summer. Here it is November and Fortinet still has not fixed the vulnerability. Volexity says that the FortiClient software fails to clear sensitive information (username, password, VPN gateway, and port) from its memory. How Fortinet failed to fix their software for so long is really hard to imagine.

• BrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA by Callum Roxan, Charlie Gardner and Paul Rascagneres of Volexity. November 15, 2024. The original report.

Palo Alto Network devices have still more bugs

CISA warns of more Palo Alto Networks bugs exploited in attacks
by Sergiu Gatlan of Bleeping Computer   November 14, 2024
Note the word "more" in the headline. These bugs are currently being exploited by bad guys. It is more of the usual: one bug lets bad guys run arbitrary OS commands as root, exposing usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. A second bug provides access to password hashes, usernames, device configurations, and device API keys) and also lets the bad guys create or read arbitrary files.

D-Link ruins the world, yet again

Today It's 60K EoL D-Link Routers That Aren't Getting Patches
by Jeremy Hellstrom of PC Perspective   November 13, 2024
Quoting: "No, It's Not A Repeat. Last Week Was 60K NAS Devices. Today in reasons to reconsider purchasing or recommending D-Link products, there are almost 60,000 D-Link DSL6740C routers that hit EoL at the beginning of this year with critical security flaws that will not be patched ... the devices were only ever sold overseas; Taiwan having the most devices ... The vulnerabilities include a 9.8 that allows an attacker to change the password of an existing account on the router, thus granting themselves as much access as they could ever want while simultaneously locking the owner out of their router. There are two more ... It is unreasonable to expect companies to support their devices forever, however with devices that can cause serious havoc across the globe we need something better than a shrug from the manufacturers."

• D-Link won't fix critical bug in 60,000 exposed EoL modems by Bill Toulas for Bleeping Computer. November 12, 2024. The article refers to the buggy device as a router in one sentence and as a modem in another sentence. From pictures, it certainly is a router. Maybe also a modem? The bugs (there are 3) are in the D-Link DSL6740C and it was discovered by security researcher Chaio-Lin Yu (Steven Meow).
• (non-US) DSL-6740C :: All H/W Revisions :: End-of-Life / End-of-Service :: CVE-2024-11068 - Unauthorized Configuration Access Vulnerability from D-Link. November 12, 2024. Some title, eh? All it says is to buy new hardware, the old thing is now a paper weight.

Security updates to most every Asus router

New firmware Update for Enhanced security
by Asus   November 4, 2024
Intro: Asus puts all their security problems on one big web page. Their routers (at least most of them) do not self-update, so the web page nags you to do the dirty work. It is also up to you to check for updates, they won't bother emailing you. The security changes are described very vaguely, nothing detailed. They say: "ASUS has released several firmware updates to enhance security" which means many of their routers are buggy. They say "Strengthened input validation and data processing workflows". No one knows what a data processing workflow is. And not validating your inputs is just lazy stupid programming. And "Improved web rendering engine, enhancing browsing experience and security." Again, weasle words looking to sound nice but most likely covering up something ugly. And "Enhanced security of system command processing to guard against potential malicious operations." No doubt, this is a biggy. There's more but you get the point - do a manual update. How many different bugs were fixed? None of your business.

OCTOBER 2024

FortiJump bug in Fortinet FortiManager

Burning Zero Days: FortiJump FortiManager vulnerability used by nation state in espionage via MSPs
by Kevin Beaumont   October 23, 2024
There is widespread exploitation of FortiNet products using a zero day and there is not even a lousy CVE (one was issued two days after this article was written). The bug has been under widespread exploitation for a while. By their clamming up, Beaumont argues that the only ones being protected is FortiGate themselves, and any governments that don't want to be embarrassed. FortiManager is a product that manages a bunch of FortiGate firewalls. The FortiManager has a Device Manager that uses FGFM to create add new devices and install policy packages and device settings. Quoting: "FortiNet made a number of errors in how this is implemented. For example, out of the box, by default, FortiManager allows any device, even with an unknown serial number, to register with FortiManager automatically and become a managed device ... Once registered, there’s a vulnerability which allows remote code execution on the FortiManager itself via the rogue FortiGate connection. From the FortiManager, you can then manage the legit downstream FortiGate firewalls, view config files, take credentials and alter configurations." Very bad. Worse is that Managed Service Providers often use FortiManager, so when they get compromised so too can all their customers get hacked. Beaumont claims that a state-sponsored group is behind the attacks on this bug. Mandiant says the bug has been exploited since June. Censys says there are over 4,000 FortiManager admin portals exposed to the Internet.

• Missing authentication in fgfmsd by FortiNet. October 25, 2024. Hey, we have a bug.

Fortinet Clams up

FortiGate admins report active exploitation 0-day. Vendor isn’t talking.
by Dan Goodin for Ars Technica   October 22, 2024
Some mistakes you just can't make. Being aware of a new critical security flaw and saying nothing to your customers, is one of those mistakes. Quoting the article:
"Fortinet, a maker of network security software, has kept a critical vulnerability under wraps for more than a week amid reports that attackers are using it to execute malicious code on servers used by sensitive customer organizations. Fortinet representatives didn’t respond to emailed questions and have yet to release any sort of public advisory detailing the vulnerability or the specific software that’s affected. The lack of transparency is consistent with previous zero-days that have been exploited against Fortinet customers. Vulnerability allowing remote code execution has been discussed since at least 9 days ago."

More Big Boys Have Bugs

CISA says critical Fortinet RCE flaw now exploited in attacks
by Sergiu Gatlan of Bleeping Computer   October 9, 2024
Bad guys have been found actively exploiting a critical FortiOS remote code execution bug. Think Little Bobby Tables and not sanitizing your input The bug lets bad guys execute commands or code on vulnerable devices in an attack that is low-complexity and does not require user interaction. Fortinet disclosed and patched this security flaw in February 2024. Yet, the US Government just got around to mandating that the fix be installed by October 30, 2024. Eight months to fix a critical bug. Why not just hang a WE USE FORTINET - HACK US poster on every government building?

• Thousands of Fortinet instances vulnerable to actively exploited flaw by Connor Jones for The Register October 14, 2024. "More than 86,000 Fortinet instances remain vulnerable to the critical flaw that attackers started exploiting last week, according to Shadowserver's data ... Carrying a CVSS v3 severity rating of 9.8, the remote code execution vulnerability is about as serious as they come." For unknown reasons, the bug has only recently caught the attention of bad guys. So, why have so many vulnerable devices not been patched in 8 months? Blame the nerds? Management? Truly miserable state of affairs.

The Big Boys Have Bugs Too

Palo Alto Networks warns of firewall hijack bugs with public exploit
by Sergiu Gatlan of Bleeping Computer   October 9, 2024
What does it say when a device purchased to increase security, is itself buggy? So buggy, that it lowers your security. There are 5 bugs, all have patches available. I can't judge 4 of the bugs, but the 5th is shameful, they put passwords in logs in clear text. Not what a security focused device should do. After installing patched software, Palo Alto users are advised to change all userids and passwords. Ugh. For context, back in April 2024, Palo Alto was seriously vulnerable - they had to release a fix for a maximum-severity zero-day bug that bad guys were found exploiting.

• PAN-SA-2024-0010 Expedition: Multiple Vulnerabilities in Expedition Lead to Exposure of Firewall Credentials by Palo Alto. October 9, 2024. Severity is 9.9 out of 10.

14 (not a typo, really 14) bugs in DrayTek routers

DrayTek fixed critical flaws in over 700,000 exposed routers
by Bill Toulas of Bleeping Computer   October 2, 2024
Where do we begin? At least the bugs have been patched. The bugs exist in 24 router models, 11 of which are End-of-Life. Due to the severity of the bugs, DrayTek has made fixes available, even for the 11 non-supported models. They are not D-Link. The most severe bug has a critical rating of 10 out of 10, which is to say: brutal (really very critical). Five of the flaws are said to require immediate attention. Looking at it another way, 2 are critical severity, 9 high severity, and 3 medium severity. Most of DrayTek recommends that the web interface to their routers only be available on the LAN side. Yet, the company that found these bugs, Verdere Labs found over 704,000 DrayTek Vigor routers exposing their web interface to the internet. No mention was made of whether there is a mobile app for administering DrayTek routers. I looked at the Release Notes for some of the fixed firmwares and they said little more than "better security". That's disappointing. This article is based on a report by Vedere Labs, which seems to be a sub-sidiary of Forescout Research. A link to the report is below along with some pretty damning quotes. On the up side, they do say that DrayTek responded promptly to their bug reports.

• Dray:Break Breaking into DrayTek routers before the threat actors do it again by Forescout Research, Vedere Labs. October 2, 2024. PDF. Quotes from the report:
  • In 2024, routers are a primary target for cybercriminals and state-sponsored attackers - and are the riskiest device category on networks. With this knowledge, we investigated one vendor with a history of security flaws to help it address its issues and prevent new attacks...
  • On Sept. 18, 2024, the Federal Bureau of Investigation announced it had taken down a botnet exploiting three CVEs on DrayTek assets (CVE-2023-242290, CVE-2020-15415 and CVE-2020-8515). Note: the bugs reported here are not related to these bugs.
  • According to the National Vulnerability Database (NVD) the first reported vulnerability for DrayTek routers appeared in 2013. As shown in Table 1, there has been a significant increase in critical vulnerabilities affecting these products over the past four years, with at least 18 issues allowing for remote code or command execution.
  • These vulnerabilities were discovered by different researchers suggesting the vendor did not perform variant analysis after receiving individual vulnerability reports and producing patches. Additionally, the presence of similar issues in different parts of the functionality indicates a lack of "post-mortem" analysis by developers.
• Release Note for Vigor2765 Series
• DrayTek Security Advisories
• 14 Bugs in DrayTek Vigor Routers Disclosed: Admin Interfaces Widely Exposed Across Major ISPs [CVE-2024-41592] from Censys. October 3, 2024. Quoting: "As of this writing, Censys has identified 751,801 exposed DrayTek Vigor routers online. These devices are predominantly located in the United Kingdom, followed by Vietnam, the Netherlands, and Taiwan ... not all observed routers are necessarily vulnerable, as specific device versions were not available."

SEPTEMBER 2024

Disgraceful D-Link bugs

D-Link fixes critical RCE, hardcoded password flaws in WiFi 6 routers
by Bill Toulas of Bleeping Computer   September 14, 2024
There are honest mistakes and then there are hard coded passwords which are inexcusable, disgraceful mistakes. D-Link disclosed and fixed five bugs in three of their routers: the COVR-X1870, the DIR-X4860 and the DIR-X5460. Three bugs are rated critical. To me, the worst of the five is that the Telnet service is enabled when the WAN port is active, allowing remote access with hard-coded passwords. The buggy routers are popular with consumers, especially among those looking for high-end WiFi 6 and mesh networking. It took D-Link over 3 months to fix the bugs. Seems like a long time. The article did not say if any of these bugs are the same as those in the DIR-846W (see below).

• DIR-X4860 / DIR-X5460 / COVR-X1870 :: TWCERT - TVN-202409021 / TVN-202409022 / TVN-202409023 / TVN-202409024 / TVN-202429025 Vulnerabilities reports details from D-Link. Not the most useful title, is it? September 16, 2024

Throw away the D-Link DIR-846W router

D-Link says it is not fixing four RCE flaws in DIR-846W routers
by Bill Toulas of Bleeping Computer   September 3, 2024
Yet another instance of router flaws that will not be fixed. And, not said in the article, is whether any other D-Link routers suffer from the same bugs. Chances are they do. As to the details: there are four remote code execution flaws in all versions of the D-Link DIR-846W router and the bugs will not be fixed. Three of the bugs are rated critical and do not require authentication. DIR-846W routers were sold primarily outside the U.S. The model is still sold in some markets, including Latin America.

• Announcement - SAP10411 (Non-US) DIR-846W : All H/W Revs. & All F/W Vers. : End-of-Life (EOL) / End-of-Service (EOS) : CVE-2024-41622/44340/44341/44342 Vulnerability Reports details from D-Link. Who makes their titles? September 1, 2024

Zyxel bugs

Security Advisories from Zyxel
Lots of Zyxel bugs in September. On the 3rd, they issued a security advisory for OS command injection vulnerability in APs and security router devices. Also on the 3rd, they issued a security advisory for multiple vulnerabilities in firewalls. And still on the 3rd, another security advisory for a buffer overflow bug in some 5G NR CPE, DSL/Ethernet CPE, fiber ONT, WiFi extender, and security router devices. Then, a week later, on the 10th a security advisory for an insufficient entropy bug with web authentication tokens in their GS1900 series switches. Also on the 10th, an advisory for an OS command injection bug in their NAS products.

AUGUST 2024

Critical Sonicwall bug

SonicOS Improper Access Control Vulnerability
a Security Advisory from SonicWall   August 22, 2024
Quoting: "An improper access control vulnerability has been identified in the SonicWall SonicOS management access and SSLVPN, potentially leading to unauthorized resource access and ... causing the firewall to crash." This means, in simple terms, bad guys can get in without knowing any passwords. The bug is being exploited in the wild, as of early September 2024. A patch was released at the end of August.

JULY 2024

Cisco, yet again

Vulnerability in Cisco Smart Software Manager lets attackers change any user password
by Dan Goodin of Ars Technica   July 17, 2024
The severity of the bug, tracked as CVE-2024-20419, is rated 10, out of 10. This is as rare as the Hope Diamond. The bug is due to a buggy implementation of the password-change process. Bad guys just need to send bad HTTP requests to a vulnerable device. A successful exploit allows the bad guy to access the web interface or the API with the privileges of the compromised user. There are no workarounds. Ars readers made many comments to the article.

Sonicwall accused of hiding a security bug

Sonicwall hidden security bug
by Catalin Cimpanu in the Risky Business security newsletter   July 17, 2024
Yet another example of how high end networking devices do not insure good security. Quoting from the newsletter: "Sonicwall hidden security bug: Vulnerability disclosure platform SSD has accused Sonicwall of secretly patching a major security flaw in its SMA100 security appliances. SSD says SMA100 appliances contained a vulnerability in a feature called Classic Mode that could have been abused for RCE attacks on authenticated users. The security firm claims Sonicwall removed Classic Mode from SMA100 devices last November without telling users of the possible threat. Sonicwall didn't include the removal in patch notes, didn't assign a CVE for the bug, and did not warn customers still using older firmware. SSD has now released a write-up and exploit code."

• SSD Advisory - SonicWall SMA100 Stored XSS to RCE by Noamr of SSD. July 12, 2024. "There are pre-auth stored XSS and post-auth remote command injection vulnerabilities in SonicWall SMA100. These vulnerabilities allow unauthenticated attackers to execute arbitrary command when an authenticated user is exposed to the stored XSS. The vulnerabilities were silently patched without any CVE assignment. The whole feature named Classic mode, where stored XSS vulnerability exists, was removed, and a new user input filtering code was added against command injection vulnerability."
• SMA 100 10.2.1 Release Notes by Sonicwall November 2023

JUNE 2024

Critical bug in Juniper routers

Juniper Networks flings out emergency patches for perfect 10 router vulnerability
by Connor Jones of The Register   July 1, 2024
Juniper Networks devices are high end. Very high. A critical bug in some Juniper devices forced the company to issue emergency patches last week. The bug, an authentication bypass issue (CVE-2024-2973) was rated 10 out of 10 which is very rare. The buggy devices are the Juniper Smart Session Router, their Session Smart Conductor management platform, and WAN Assurance Routers. Only devices using high-availability redundant configurations are vulnerable. This is one indication of how high end Juniper products are - they actually researched the problem and reported on which of their devices are vulnerable and which are not. Very different from consumer routers.

Bug in D-Link router illustrates much about consumer routers

Hackers exploit critical D-Link DIR-859 router flaw to steal passwords
by Bill Toulas of Bleeping Computer   June 29, 2024
The D-Link DIR-859 router is old and has been retired (End of Life or EoL) by the company. It also has a critical bug that lets bad guys get total control of the router. The points that this illustrates about consumer routers:

1. D-Link can not be shamed into offering a fix
2. Both the article and the D-Link response are about one router model. What about other D-Link models? Might they share the same bug? None of our business.
3. D-Link says nothing about contacting owners of the buggy router to tell them about the security flaw. They have your money and are done with you.
4. The bug was disclosed in January 2024, so why is this article, and the note from D-Link, appearing six months later?

 Such is the state of consumer routers, and that is the real take-away here.

• DIR-859 :: All Revisions :: All Firmware :: End-of-Life / End-of-Service :: Reported Vulnerabilities from D-Link. No date. No specifics on the bug. Buy another router.

A flood of bugs in Asus routers

High-severity vulnerabilities affect a wide range of Asus router models
by Dan Goodin of Ars Technica   June 17, 2024
Yikes. Multiple critical vulnerabilities that allow bad guys to remotely take control of many Asus router models. No authentication needed. No mistake by the router owner or users needed. One bug, (CVE-2024-3080) is an authentication bypass flaw that lets remote attackers log into a device. Routers with this bug are the Asus XT8, XT8_V2, RT-AX88U, RT-AX58U, RT-AX57, RT-AC86U, RT-AC68U. These same models also suffer from a second bug. A third bug allows remote hackers to execute commands with no user authentication. That bug affects these models: DSL-N12U_C1, DSL-N12U_D1, DSL-N14U, DSL-N14U_B1, DSL-N16, DSL-N17U, DSL-N55U_C1, DSL-N55U_D1, DSL-N66U, DSL-AC51/DSL-AC750, DSL-AC52U, DSL-AC55U, DSL-AC56U. There are fixes for these models. However, the same third bug is in these models which are too old and will not be fixed: DSL-N10_C1, DSL-N10_D1, DSL-N10P_C1, DSL-N12E_C1, DSL-N16P, DSL-N16U, DSL-AC52 and DSL-AC55. You might think if you owned an Asus router and registered with them, that they would tell you about critical updates like this by email. But, no. Some of these models can auto-update but there are complaints about the Asus auto updating system. Ars reader comments show some very unhappy customers who tried to install the patches. Three critical bugs. At some point, you have to wonder if maybe Asus is just not very good at this whole router thing.
Proving this theory is the article below from Bleeping Computer. It adds that ASUS has also updated Download Master, a utility that enables you to download files directly to a USB storage device connected to the router. It supports torrent, HTTP and FTP with the last two being miserably insecure. The update fixes five medium to high-severity bugs. So, that's 8 recent bugs, if you are counting.

• Latest security updates from Asus
• How to update the firmware of your router to the latest version (WebGUI) Last Update : January 30, 2024
• How to update the firmware of your router to the latest version via ASUS Router App Last update: August 7, 2023 or maybe July 8, 2023.
• ASUS warns of critical remote authentication bypass on 7 routers by Bill Toulas for Bleeping Computer. June 15, 2024

MAY 2024

TP-Link router with a HUGE bug

Security Advisory: Remote Command Execution on TP-Link Archer C5400X
by OneKey   May 27, 2024
This a huge bug, the severity was rated 10 out of 10, which is pretty rare. The router exposes a network listener on TCP ports 8888, 8889, and 8890. This listener software is vulnerable to command injection and buffer overflows. A bad guy that exploits this flaw gets total control of the router. Game over. What is not addressed by either OneKey, the company that found the bug or by TP-Link is whether this is the only router with the bug. TP-Link makes dozens of different routers. This is the typical pattern with consumer routers, a security person/company tests one model, finds a bug, the company fixes the bug in that one model and no one bothers to check any other models running similar firmware. On the page on this site about dealing with a new router, I suggest connecting it to an existing router and running nmap or another port scan product on the WAN port of the router. This would have exposed the open TCP ports. No consumer router should have any open ports out-of-the-box.

• TP-Link fixes critical RCE bug in popular C5400X gaming router by Bill Toulas for Bleeping Computer. May 27, 2024
• This is the buggy Archer C5400X router
• Statement on Remote Command Execution on Archer C5400X(CVE-2024-5035) Security Advisory from TP-Link. Last Updated May 31, 2024.
• The new firmware: Download for Archer C5400X V1.60. As if not commenting on whether any other routers have the same bug was not bad enough, TP-Link again shows their true corporate personality when they explain the change in this version of the firmware: "Enhanced system security and stability.". Their not being able to be honest about this, and fully explain how bad the bug was, is another reason to avoid their products.

APRIL 2024

None of your business

Asus Product Security Advisory
by Asus   April 12, 2024
Just like the TP-Link bugs below, this too, illustrates what is wrong with consumer routers. The Asus Product Security Advisory page shows that security related bug fixes were issued for these models: EBM68, EBR63 and RT-AX57 Go. Period. That's all it says. What was the bug? How serious is it? Is there a work-around? Were there multiple bugs? None of your [expletive deleted] business. Asus customers are not entitled to this information.

Bugs in TP-Link routers and APs

Vulnerability in some TP-Link routers could lead to factory reset
by Jonathan Munshaw of Cisco Talos   April 10, 2024
These bugs illustrate everything wrong with consumer routers. For one thing, which models are buggy? Talos can not test every TP-Link device, they test a few and find bugs. What about the others? Talos can't know and TP-Link says nothing, issuing fixes for the few tested models. Also, TP-Link says nothing about any of this on their Security Advisory page. This is quite different from the March 2024 bug in Netgear routers shown below. There, Netgear was very clear about the affected models. Talos found four bugs and told TP-Link on Dec 11, 2023. Fixes were issued April 3, 2024. Too long? Matter of opinion, judge for yourself.

MARCH 2024

Bug in 3 Netgear routers

Netgear RAX30 JSON Parsing getblockschedule() stack-based buffer overflow vulnerability
by Cisco Talos   March 7, 2024
"A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 ... A specially crafted HTTP request can lead to code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability." Discovered by Michael Gentile of Cisco Talos. Not the worst bug as the bad guy has to be on your LAN to exploit it. Netgear is clear about which models are buggy: RAX28, RAX29 and RAX30. Talos told Netgear about the bug Dec 6, 2023. Netgear issued a fix March 6, 2024.

• Security Advisory for Post-Authentication Stack Overflow on the RAX30 from Netgear. March 6, 2024.

FEBRUARY 2024

Lots of critical Fortinet bugs

Fortinet's week to forget: Critical vulns, disclosure screw-ups, and that toothbrush DDoS attack claim
by Connor Jones of The Register   February 9, 2024
TLDR: you pay for more security, you end up less secure. And, Fortinet seems like a Mickey Mouse company. There is "yet another critical security vulnerability in FortiOS". This one is CVE-24-21762 and it is rated 9.6 for severity. The bug impacts unsupported versions, of FortiOS and the company will not issue fixes for those versions, forcing customers to upgrade or switch vendors. This critical bug comes a few days after the disclosure of two other critical FortiOS bugs on February 6. The earlier disclosure "... immediately attracted our attention since it's not too often we hear about two maximum severity bugs being disclosed on the same day, impacting a major security product like FortiSIEM. However, that's what happened on Tuesday with both CVE-2024-23108 and CVE-2024-23109 appearing in the National Vulnerability Database (NVD)."
On top of the three critical bugs, the way Fortinet handled things was shameful. The Register called them "unprofessional". In regard to the first two bugs, the article says "Firstly, Fortinet backtracked and said these weren't vulnerabilities at all, instead explaining that they were issued in error and were duplicates of the single vulnerability mentioned in the aforementioned October advisory - CVE-2023-34992. Then, within hours of this, the company backtracked again saying that yes, actually, these are two new vulnerabilities - two bypasses for October's CVE-2023-34992. This came after the researcher credited with the discoveries published the email from Fortinet confirming the findings were indeed actual vulnerabilities".

2023

DECEMBER 2023

21 Bugs in Sierra Wireless routers

Sierra: 21 vulnerabilities impact critical infrastructure routers
by Bill Toulas of Bleeping Computer   December 6, 2023
"A set of 21 newly discovered vulnerabilities impact Sierra OT/IoT routers and threaten critical infrastructure with remote code execution, unauthorized access, cross-site scripting, authentication bypass, and denial of service attacks." Catch that? 21 bugs. 21. The flaws were discovered by Forescout Vedere Labs. They affect Sierra Wireless AirLink cellular routers and open-source components like TinyXML and OpenNDS. TinyXML is EoL, so no fix there. The other bugs have available fixes. One bug is considered critical, eight of them are high severity score, and a dozen were considered a medium risk. Forescout found over 86,000 AirLink routers exposed online in organizations engaged in power distribution, vehicle tracking, waste management, and national health services.

• Forescout Vedere Labs discloses 21 new vulnerabilities affecting OT/IoT routers by Forescout Vedere Labs December 5, 2023

OCTOBER 2023

Chinese hackers must love Cisco. Cisco customers, not so much

'Cisco buried the lede.' Over 10,000 network devices backdoored through unpatched zero day
by Dan Goodin for Ars Technica   October 17, 2023
Yet another Cisco shit show. Their devices are being hacked left and right. It's a new bug and there was no fix at the time this was publicly disclosed. The bug is CVE-2023-20198 and it is rated 10 out of 10, the worst possible case. The bug is relatively easy to exploit. The bug is in the Web User Interface of their IOS XE software. The number of already hacked devices came from security firm VulnCheck and they had not finished their scan when the article was written. About a week after the s... hit the fan, it was disclosed that over 40,000 Cisco devices had been hacked. The bug lets a bad guy create an admin account on the vulnerable device. Cisco released a fix on Oct 23, 2023.

• Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities by Cisco Talos. Issued Oct 16, 2023. Last updated Oct 23. Now there are two bugs.
• Widespread Cisco IOS XE Implants in the Wild by Jacob Baines of VulnCheck Oct 17, 2023
• Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature by Cisco. Issued Oct 16, 2023. Last update Oct 23. Links to the fix.
• Cisco fixes critical IOS XE bug but malware crew way ahead of them by Jessica Lyons Hardcastle for The Register. October 23, 2023

Buggy software on high end hardware

Juniper Networks Patches Over 30 Vulnerabilities in Junos OS
by Ionut Arghire of Security Week   October 13, 2023
Juniper Networks patches over 30 vulnerabilities in Junos OS and Junos OS Evolved, including nine high-severity bugs. This is bad enough, but it was only two months ago, that Juniper patched another clump of severe bugs. My writeup for those bugs is below, filed under September. They are quite the bug factory.

Cisco makes the same huge mistake over and over

Cisco Can’t Stop Using Hard-Coded Passwords
by Bruce Schneier   October 11, 2023
Quoting: "This is not the first time Cisco products have had hard-coded passwords made public. You’d think it would learn."

• Cisco Emergency Responder Static Credentials Vulnerability by Cisco October 4, 2023. Quoting: "A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development."

SEPTEMBER 2023

Patched Juniper bugs being ignored by nerds

Thousands of Juniper Junos firewalls still open to hijacks, exploit code available to all
by Jessica Lyons Hardcastle of The Register   September 18, 2023
On August 17th of this year, Juniper revealed and addressed five bugs that appear in all versions of Junos OS on SRX firewalls and EX Series switches. Then, on August 25, watchTowr published a proof of concept exploit for two of the bugs, used together, that allowed unauthenticated bad guys to get remote code execution by uploading two files. Then, on September 18th, VulnCheck CTO Jacob Baines published a report claiming that just one of the bugs, all by itself, was sufficient for remote bad guys to totally hack a buggy device. VulnCheck has also released a scanning tool to identify firewalls vulnerable to this bug. VulnCheck believes the majority of affected internet-facing firewalls (79 percent or about 15,000 devices) still are not patched. Quoting: Juniper did not respond to The Register's inquiries about the new RCE exploit, the confusing CVE descriptions, or the number of still-vulnerable devices.

• All Juniper Security Vulnerabilities. Pretty long list.
• Security Bulletin: Junos OS: SRX Series and EX Series: Multiple vulnerabilities in J-Web can be combined to allow a preAuth Remote Code Execution from Juniper. Article ID JSA72300. Aug 17, 2023. Updated Sept 7, 2023.

Huge security flaws in 3 Asus routers

ASUS routers vulnerable to critical remote code execution flaws
by Bill Toulas of Bleeping Computer   September 5, 2023
Lazy programming strikes again. There is no excuse for this crap other than second (or third) rate programmers. The Asus RT-AX55, RT-AX56U_V2 and RT-AC86U routers all have critical security bugs that are as bad as bad gets. These are high end models favored by gamers for their performance. The bugs are known as format string errors. That is polite talk. In simpler terms user input was not sanitized. Little Bobby Tables. The bugs can be exploited remotely and without authentication, potentially allowing remote code execution. Bug fixes have been trickling out over the last couple months.

• ASUS GAMING ROUTERS ARE GETTING GAMED; UPDATE EARLY, UPDATE OFTEN by Jeremy Hellstrom for PC Per Sept 5, 2023

JULY 2023

Mikrotik is clearly not trustworthy. Their poor security practices make a bug much worse

Super Admin elevation bug puts 900,000 MikroTik devices at risk
by Bill Toulas of Bleeping Computer of   July 25, 2023
A bug, known as CVE-2023-30799, allows bad guys with an existing admin account to elevate their privileges to "super-admin" a level that was never intended to be given to anyone. This level of access was intended for use only by certain parts of the router operating system. Although the requirement to first have an admin account sounds like a high bar to clear, the article explains that due to generally miserable security practices, it is not a very high bar. First off, the Mikrotik RouterOS system does not prevent password brute-force attacks. And, it comes with a default admin userid, as do many routers. To me, the biggest disgrace is that until October 2021 the default admin password was an empty string. Clearly Mikrotik cares nothing about security. In contrast, Peplink forces you to change the router password immediately after the default one is used the first time. And, RouterOS will accept any password, there is no such thing as too short a password. The bug was first disclosed to Mikrotik in June 2022 and they fixed it 4 months later in the stable version of RouterOS. The flaw was found by Margin Research employees, Ian Dupont and Harrison Green. However, Mikrotik did not fix the bug in the long-term version of the OS until just now (July 2023). Why the delay? According to VulnCheck, the long-term version of the OS was only fixed after they nagged Mikrotik about it. Oopsie. One estimate is that 474,000 Mikrotik routers expose their web interface to the Internet and thus are vulnerable.

• Exploiting MikroTik RouterOS Hardware with CVE-2023-30799 by Jacob Baines of VulnCheck. July 25, 2023. Even more evidence that Mikrotik is not trustworthy: when they fixed the bug in October 2022, the release notes did not indicate that a security problem was addressed.
• Securing Your Router from Mikrotik for Linux techies only.

JUNE 2023

Fortinet again

Fortinet fixes critical RCE flaw in Fortigate SSL-VPN devices, patch now
by Lawrence Abrams of Bleeping Computer   June 11, 2023
Fortinet devices are popular, making them a prime target for attacks. This bug is estimated to impact over 500,000 devices. Yikes. Fortinet is known to push out security patches prior to disclosing critical vulnerabilities to give customers time to update their devices before threat actors can reverse engineer the patches. They seem to have done so, fixes are available for an undisclosed, critical pre-authentication remote code execution vulnerability known as CVE-2023-27997 (Fortinet calls it FG-IR-23-097). The bug is a heap-based buffer overflow in FortiOS and FortiProxy SSL-VPN. It can let unauthenticated bad guys run software on the box (RCE). One article said the bug was discovered during a code audit of the SSL-VPN module following attacks against government organizations exploiting the recent FortiOS bug known as CVE-2022-42475. Another article said it was discovered by Lexfo Security researchers Charles Fol and Dany Bach.
Update: 300,000+ Fortinet firewalls vulnerable to critical FortiOS RCE bug by Bill Toulas of Bleeping Computer. July 3, 2023. If you thought a critical bug in a critical device would be quickly fixed, you don't know how IT works in 2023. Security company Bishop Fox reported that more than 2 weeks after Fortinet issued their bug fix, most of their devices remain vulnerable. Specifically, Bishop Fox found 153,414 FortiGate firewall boxes had been updated and over 300,000 had not. What could be worse? They also found that many of the exposed FortiGate devices had not received an update for the past eight years. 8 [expletive] years.

• Fortinet: New FortiOS RCE bug 'may have been exploited' in attacks by Sergiu Gatlan for Bleeping Computer. June 12, 2023. I think it is safe to say that "may have been exploited" means that it was indeed exploited.
• FortiOS & FortiProxy - Heap buffer overflow in sslvpn pre-authentication from Fortinet. June 12, 2023
• CVE-2023-27997 is Exploitable, and 69 percent of FortiGate firewalls are vulnerable by Caleb Gross of Bishop Fox. June 30, 2023

Asus fixes NINE security flaws

ASUS urges customers to patch critical router vulnerabilities
by Sergiu Gatlan of Bleeping Computer   June 19, 2023
Asus released bug fixes for nine security flaws that affect many different models. Two fixes are rated Critical and six are rated High in severity. One is still being evaluated. The vulnerable models are: GT6, GT-AXE16000, GT-AX11000 PRO, GT-AXE11000, GT-AX6000, GT-AX11000, GS-AX5400, GS-AX3000, XT9, XT8, XT8 V2, RT-AX86U PRO, RT-AX86U, RT-AX86S, RT-AX82U, RT-AX58U, RT-AX3000, TUF-AX6000, TUF-AX5400. That the bugs effect 19 different models is an improvement, and a big one at that. Many reports about router bugs are said to only apply to a single model and I very much doubt that is ever true. Full details from Asus:
Fixed CVE-2023-28702, CVE-2023-28703, CVE-2023-31195, CVE-2022-46871, CVE-2022-38105, CVE-2022-35401, CVE-2018-1160, CVE-2022-38393, CVE-2022-26376
Fixed DoS vulnerabilities in firewall configuration pages.
Fixed DoS vulnerabilities in httpd.
Fixed information disclosure vulnerability.
Fixed null pointer dereference vulnerabilities.
Fixed the cfg server vulnerability.
Fixed the vulnerability in the logmessage function.
Fixed Client DOM Stored XSS
Fixed HTTP response splitting vulnerability
Fixed status page HTML vulnerability.
Fixed HTTP response splitting vulnerability.
Fixed Samba related vulerabilities.
Fixed Open redirect vulnerability.
Fixed token authentication security issues.
Fixed security issues on the status page.
Enabled and supported ECDSA certificates for Let's Encrypt.
Enhanced protection for credentials.
Enhanced protection for OTA firmware updates.

MAY 2023

Still more critical Zyxel bugs

Zyxel warns of critical vulnerabilities in firewall and VPN devices
by Bill Toulas of Bleeping Computer   May 25, 2023
Quoting: "Zyxel is warning customers of two critical-severity vulnerabilities in several of its firewall and VPN products that attackers could leverage without authentication. Both security issues are buffer overflows and could allow denial-of-service (DoS) and remote code execution on vulnerable devices." Both bugs are rated 9.8 out of 10 which means they are really really bad. Bug fixes are available. Bugs are CVE-2023-33009 and CVE-2023-33010. A different Zyxel bug, one that had a patch released in April 2023, is being actively exploited by bad guys. That bug affects the same firewall and VPN products as these two.

• Zyxel security advisory for multiple buffer overflow vulnerabilities of firewalls from Zyxel. May 24, 2023.

Still more critical Cisco bugs

Cisco squashes critical bugs in small biz switches
by Jeff Burt of The Register   May 18, 2023
Cisco software has more critical bugs than grains of sand on a beach. This time, there are four critical security vulnerabilities in several of their switches. And, of course, Cisco did not find the bugs on their own, someone else reported them. The flaws are in the web interface and they can be used to run arbitrary code with root privileges. All the bugs have a CVSS severity rating of 9.8 out of 10. As we have many times before with Cisco, the bugs are due to improper validation of requests sent to the web interface. It's like they are not even trying. Or, their programmers are a lazy as lazy gets. Buggy devices: the 250 Series smart switches, 350 Series managed switches, 350X Series and 550X stackable managed switches. Also the Business 250 Series smart switches and Business 350 Series managed switches. The bugs are CVE-2023-20159, CVE-2023-20160, CVE-2023-20161 and CVE-2023-20189. Another thing we have seen before with Cisco: three other buggy switches won't be fixed because they are toooooooooooooooooooo old.

• Cisco Small Business Series Switches Buffer Overflow Vulnerabilities Critical Advisory ID: cisco-sa-sg-web-multi-S9g4Nkgv. May 17, 2023

Still another Fortinet bug

A More Complete Exploit for Fortinet CVE-2022-42475
by Carl Livitt and Jon Williams of Bishop Fox   May 17, 2023
On this page is a writeup about a bug in Fortinet FortiOS software from March 2023 and another writeup about another bug from October 2022. This is yet another bug. Quoting: "Recently, there has been some buzz about remotely exploitable vulnerabilities in Fortinet security appliances, especially FortiGate firewalls. This blog focuses on one such bug: CVE-2022-42475, a remotely exploitable heap overflow in the SSL VPN component of FortiGate and FortiProxy appliances. It was discovered in the wild by Fortinet in late 2022 during an investigation into a compromised firewall. " The article is a very detailed look at the bug.

• Analysis of FG-IR-22-398 – FortiOS - heap-based buffer overflow in SSLVPNd by Carl Windsor, Guillaume Lovet, Hongkei Chan, and Alex Kong of Fortinet. January 11, 2023. FYI FG-IR-22-398 is the same as CVE-2022-42475

APRIL 2023

Many Many Zyxel bugs

Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks - Patch Now
by Ravie Lakshmanan of Hacker News   April 28, 2023
Zyxel just released three security advisories to fix what looks like nine different bugs in their assorted devices. Each clump of bugs was found a different security company. The first clump is a lone critical security flaw in its firewall devices can be exploited to achieve remote code execution on buggy systems. This affects ATP, USG FLEX, VPN and ZyWALL/USG. The second clump of fixes includes a high-severity post-authentication command injection bug that affects select firewall versiions and permits an authenticated bad guy to execute OS commands remotely. The third clump of fixes includes five high-severity flaws and one medium-severity bug affecting several firewalls and APs. These bugs could result in code execution and cause a denial-of-service. You may also want to scan the rest of this page and site for more references to Zyxel.

• Zyxel security advisory for OS command injection vulnerability of firewalls CVE-2023-28771 April 25, 2023
• Zyxel security advisory for XSS vulnerability and post-authentication command injection vulnerability in firewalls CVE-2023-27990, CVE-2023-27991 April 25, 2023
• Zyxel security advisory for multiple vulnerabilities of firewalls and APs CVE-2023-22913, CVE-2023-22914, CVE-2023-22915, CVE-2023-22916, CVE-2023-22917 and CVE-2023-22918 April 25, 2023
• Zyxel's latest security announcements and advices for some perspective

One TP-Link router is buggy. Other models? None of your damn business

TP-Link Archer WiFi router flaw exploited by Mirai malware
by Bill Toulas of Bleeping Computer   April 25, 2023
"The Mirai malware botnet is actively exploiting a TP-Link Archer A21 (AX1800) WiFi router vulnerability tracked as CVE-2023-1389 to incorporate devices into DDoS (distributed denial of service) swarms. Researchers first abused the flaw during the Pwn2Own Toronto hacking event in December 2022, where two separate hacking teams breached the device using different pathways LAN and WAN side." This is a big time bug, a bad guy can use it to execute arbitrary code in the context of root. Like many bugs, this due the programmers being lazy and not validating user input. It seems the programmers are stupid too, the company first attempted to fix this in February, but the fix was incomplete. Personally, I do not want to use firmware written by lazy stupid people. Adding insult to injury, in their description of the fixed firmware, this is all TP-Link says: "Fixed some security issues." And, the biggest reason not to use a router from TP-Link is their other 23 models of routers. Are they buggy too? No one says. How likely is it that of the many many different router models, only this one has the bug.

• (Pwn2Own) TP-Link Archer AX21 merge_country_config Command Injection Remote Code Execution Vulnerability from the Zero Day Initiative April 24, 2023.

Yet another reason to use VLANs

With ICMP magic, you can snoop on vulnerable HiSilicon, Qualcomm-powered Wi-Fi
by Thomas Claburn of The Register   April 7, 2023
Sub-heading: WPA stands for will-provide-access, if you can successfully exploit a target's setup
"A vulnerability identified in at least 55 Wi-Fi router models can be exploited by miscreants to spy on victims' data as it's sent over a wireless network." At least 55 routers. The bug is in Qualcomm and HiSilicon chips found in various wireless access points. The flaw (CVE-2022-25667) prevents the devices from blocking forged Internet Control Message Protocol (ICMP) messages. These scam messages can be abused to hijack and observe a victim's wireless connectivity. The technical pre-reqs to abuse this flaw are fairly high. A bad guy can onl intercept and snoop on the traffic of another device on the same network. The bad guy also needs to be able to directly communicate with the victim device and know the victim's IP address. In addition, the bad guy must find an open UDP port on the victim device - any open port will do. Needless to say, intercepted traffic is safer if encrypted, so HTTPS and secure DNS are great defenses. The bug seems widespread, they tested 55 products from ten vendors and all were buggy. The vulnerable devices they tested were made by: Cisco, Netgear, 360, Mercury, Xiaomi, Ruijie, H3C, Huawei, Tenda and TP-Link.

• Man-in-the-Middle Attacks without Rogue AP: When WPAs Meet ICMP Redirects The paper that the article is based on. Many authors.

MARCH 2023

D-Link drops the ball on security

Security Bulletin by D-Link   March 2023
D-Link says "The security and performance of your D-Link devices is of utmost importance to us across all product lines." And yet, take a look at the web page where they publish Security Advisories. Nothing from 2021. Nothing from 2022. Nothing from this year either. Very suspicious. Especially since the items below show there have been security issues with D-Link routers.

• D-Link Multiple Routers lighttpd Stack-based Buffer Overflow Remote Code Execution Vulnerability by Zero Day Initiative. September 20, 2022
• The above article links to this: DIR-867 Rev A1 FW v1.30B07 / DIR-878 Rev. A1 FW v1.30B08 / DIR-882-US Rev A1 FW v1.30B08 : CVE-2022-41140 :: LAN-Side Lighttpd Unauthenticated Buffer Overflow & RCE Vulnerability from D-Link. It says D-Link was informed of a security flaw in Feb. 2022 but the fixes are still under development. As I write this, it is a year later. And the article itself is not dated.
• CVE-2023-24762 is a command injection vulnerability in D-Link DIR-867 devices. It was made public by NIST in March 2023. D-Link has been silent about it.
• Debugging D-Link: Emulating firmware and hacking hardware by Matthew Remacle of Greynoise. March 17, 2023. "D-Link was notified of CVE-2022-41140, a buffer overflow vulnerability on February 17th, 2022. By November 15th, 2022, no additional information was available..."

Netgear is having a bad stretch

NETGEAR Product Security
Reading about the March 2023 Netgear bugs sent me to the NETGEAR page where they list all their security bug fixes. Pretty big list as you can see below. Netgear issued 18 security bug fixes this month, 26 security bug fixes in December and 70 in November. Chances are, there were some non-security bugs too. I am starting to consider that perhaps Netgear is not very good at software.

3/22/2023 Security Advisory for Cleartext Transmission on Some Orbi WiFi Systems, PSV-2022-0189
3/22/2023 Security Advisory for Command Injection on Some Orbi WiFi Systems, PSV-2022-0188
3/22/2023 Security Advisory for Command Injection on Some Orbi WiFi Systems, PSV-2022-0187
3/22/2023 Security Advisory for Post-authentication Command Injection on the RBR750, PSV-2022-0186
3/15/2023 Security Advisory for Post-Authentication Stack Overflow on Some Routers, PSV-2022-0182
3/15/2023 Security Advisory for Authentication Bypass on Some Routers, PSV-2021-0264
3/15/2023 Security Advisory for Security Misconfiguration on Some Routers and WiFi Systems, PSV-2021-0196
3/15/2023 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2021-0182
3/15/2023 Security Advisory for Post-Authentication Command Injection on Some WiFi Systems, PSV-2021-0179
3/15/2023 Security Advisory for Pre-Authentication Command Injection on Some Router and Extenders, PSV-2021-0076
3/15/2023 Security Advisory for Pre-Authentication Buffer Overflow on Some Routers, PSV-2020-0578
3/15/2023 Security Advisory for Post-Authentication Stack Overflow on Some Routers and Extenders, PSV-2020-0482
3/14/2023 Security Advisory for Post-Authentication Stack Overflow on Some Routers, PSV-2020-0481
3/14/2023 Security Advisory for Post-Authentication Stack Overflow on Some Routers, PSV-2020-0325
3/14/2023 Security Advisory for Denial of Service on Some Routers, PSV-2020-0283
3/14/2023 Security Advisory for Post-Authentication Buffer Overflow on Some Routers, PSV-2020-0213
3/14/2023 Security Advisory for Security Misconfiguration on Some Routers, PSV-2017-2454
3/9/2023 Security Advisory for Multiple Vulnerabilities on the RAX30, PSV-2022-0352
2/14/2023 Security Advisory for Pre-Authentication Command Injection on Some Cable Modem Routers, PSV-2022-0208
12/28/2022 Security Advisory for Denial of Service on Some Routers, PSV-2019-0104
12/28/2022 Security Advisory for Pre-Authentication Buffer Overflow on Some Routers, PSV-2019-0208
12/28/2022 Security Advisory for Security Misconfiguration on Some Routers, PSV-2019-0265
12/28/2022 Security Advisory for Authentication Bypass on CAX30, PSV-2022-0196
12/28/2022 Security Advisory for Pre-Authentication Buffer Overflow on Some Routers, Extenders, and WiFi Systems, PSV-2021-0275
12/28/2022 Security Advisory for Denial of Service on Some WiFi Systems, PSV-2021-0165
12/28/2022 Security Advisory for Denial of Service on Some Routers and WiFi Systems, PSV-2021-0189
12/28/2022 Security Advisory for Post-Authentication Command Injection on CAX30, PSV-2022-0194
12/28/2022 Security Advisory for Authentication Bypass on CAX30, PSV-2022-0195
12/28/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0194
12/28/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0221
12/28/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0249
12/28/2022 Security Advisory for Post-Authentication Buffer Overflow on Some Routers and WiFi Systems, PSV-2020-0333
12/28/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0478
12/28/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0549
12/28/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0568
12/28/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0569
12/28/2022 Security Advisory for Denial of Service on Some WiFi Systems, PSV-2020-0288
12/28/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0565
12/28/2022 Security Advisory for Sensitive Information Disclosure on Some Routers and WiFi Systems, PSV-2020-0428
12/28/2022 Security Advisory for Sensitive Information Disclosure on ReadyNAS OS 6, PSV-2022-0036
12/28/2022 Security Advisory for Sensitive Information Disclosure on Insight iOS App, PSV-2022-0094
12/28/2022 Security Advisory for Sensitive Information Disclosure on Some WiFi Systems, PSV-2020-0448
12/28/2022 Security Advisory for Denial of Service on Some WiFi Systems, PSV-2022-0165
12/13/2022 Security Advisory for Pre-authentication Buffer Overflow on the RAX30, PSV-2022-0291
12/13/2022 Security Advisory for Multiple Vulnerabilities on the RAX30, PSV-2022-0028 & PSV-2022-0073
11/23/2022 Security Advisory for Pre-Authentication Buffer Overflow on RAX120, PSV-2022-0018
11/8/2022 Security Advisory for Denial of Service on Some Routers, PSV-2022-0001
11/8/2022 Security Advisory for Pre-Authentication Command Injection on Some Routers, PSV-2019-0289
11/8/2022 Security Advisory for Security Misconfiguration on R7000, PSV-2020-0005
11/8/2022 Security Advisory for Pre-Authentication Command Injection on Some Routers, PSV-2022-0096
11/8/2022 Security Advisory for Pre-Authentication Stack Overflow on Some Routers, PSV-2019-0121
11/8/2022 Security Advisory for Security Misconfiguration on R6700v3, PSV-2019-0065
11/8/2022 Security Advisory for Post-Authentication Stack Overflow on Some Routers and Extenders, PSV-2019-0145
11/8/2022 Security Advisory for Post-Authentication Command Injection on Some Routers, PSV-2022-0060
11/8/2022 Security Advisory for Pre-Authentication Buffer Overflow on Some Routers, PSV-2019-0087
11/8/2022 Security Advisory for Denial of Service on Some Routers and Extenders, PSV-2019-0159
11/8/2022 Security Advisory for Post-Authentication Stack Overflow on Some Routers, PSV-2019-0156
11/8/2022 Security Advisory for Post-Authentication Stack Overflow on Some Routers and Extenders, PSV-2019-0155
11/8/2022 Security Advisory for Denial of Service on Some Routers, PSV-2019-0164
11/8/2022 Security Advisory for Post-Authentication Stack Overflow on Some Routers, PSV-2019-0196
11/8/2022 Security Advisory for Stored Cross Site Scripting on Some Routers, PSV-2020-0016
11/7/2022 Security Advisory for Sensitive Information Disclosure on Some Routers, Extenders, and WiFi Systems, PSV-2020-0122
11/7/2022 Security Advisory for Pre-Authentication Buffer Overflow on Some Switches, PSV-2022-0016
11/7/2022 Security Advisory for Pre-Authentication Buffer Overflow on Some Switches, PSV-2022-0015
11/7/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0518
11/7/2022 Security Advisory for Denial of Service on Some Routers, PSV-2021-0315
11/7/2022 Security Advisory for Authentication Bypass on Some Routers and Extenders, PSV-2021-0316
11/7/2022 Security Advisory for Denial of Service on Some WiFi Systems, PSV-2022-0033
11/7/2022 Security Advisory for Post-authentication Buffer Overflow on Some Routers, PSV-2022-0156
11/7/2022 Security Advisory for Pre-authentication Buffer Overflow on Multiple Products, PSV-2022-0155
11/7/2022 Security Advisory for Pre-authentication Stack Overflow on some Routers and Nighthawk WiFi Mesh Systems, PSV-2022-0146
11/7/2022 Security Advisory for Pre-Authentication Buffer Overflow on Some Routers and WiFi Systems, PSV-2021-031
11/7/2022 Security Advisory for Multiple Vulnerabilities on the R7000P, PSV-2022-0144 & PSV-2022-0145
11/7/2022 Security Advisory for Pre-Authentication Command Injection on R7000, PSV-2022-0115
11/7/2022 Security Advisory for Post-Authentication Command Injection on R6260, PSV-2021-0271
11/7/2022 Security Advisory for Pre-Authentication Stack Overflow on Some Routers, PSV-2021-0346
11/7/2022 Security Advisory for Pre-Authentication Stack Overflow on Some Routers, PSV-2021-0347
11/7/2022 Security Advisory for Post-Authentication Stack Overflow on R7000, PSV-2019-0167
11/7/2022 Security Advisory for Denial of Service on Some Routers, PSV-2019-0118
11/7/2022 Security Advisory for Pre-Authentication Buffer Overflow on Some Routers, PSV-2021-0304
11/7/2022 Security Advisory for Post-Authentication Buffer Overflow on Some Routers, PSV-2020-0345
11/7/2022 Security Advisory for Pre-Authentication Buffer Overflow on R7000P, PSV-2020-0344
11/7/2022 Security Advisory for Denial of Service on SomeWiFi Systems, PSV-2020-0295
11/7/2022 Security Advisory for Denial of Service on Some Routers, PSV-2020-0299
11/7/2022 Security Advisory for Post-Authentication Buffer Overflow on Some Routers, PSV-2020-0303
11/7/2022 Security Advisory for Post-Authentication Buffer Overflow on Some Routers, PSV-2020-0314
11/7/2022 Security Advisory for Post-Authentication Buffer Overflow on R7000P, PSV-2020-0312
11/7/2022 Security Advisory for Post-Authentication Buffer Overflow on R7000P, PSV-2020-0310
11/7/2022 Security Advisory for Post-Authentication Buffer Overflow on R7000P, PSV-2020-0311
11/7/2022 Security Advisory for Stored Cross Site Scripting on Some Routers and WiFi Systems, PSV-2020-0209
11/7/2022 Security Advisory for Sensitive Information Disclosure on Some Routers, Extenders, and WiFi Systems, PSV-2020-0457
11/7/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0217
11/7/2022 Security Advisory for Stored Cross Site Scripting on EX7500, PSV-2020-0252
11/7/2022 Security Advisory for Stored Cross Site Scripting on EX7500, PSV-2020-0251
11/7/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0259
11/7/2022 Security Advisory for Denial of Service on WiFi Systems, PSV-2020-0260
11/7/2022 Security Advisory for Post-Authentication Stack Overflow on R7000P, PSV-2020-0267
11/7/2022 Security Advisory for Post-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0358
11/7/2022 Security Advisory for Post-Authentication Command Injection on Some Router, PSV-2022-0012
11/7/2022 Security Advisory for Stored Cross Site Scripting on Some Routers, PSV-2020-0447
11/7/2022 Security Advisory for Pre-Authentication Command Injection on Some Routers and WiFi Systems, PSV-2020-0589
11/7/2022 Security Advisory for Missing Function Level Access Control on Some Routers, PSV-2022-0127
11/7/2022 Security Advisory for Missing Function Level Access Control on R7000, PSV-2022-0133
11/7/2022 Security Advisory for Denial of Service on Some Routers, Extenders, and WiFi Systems, PSV-2021-0153
11/7/2022 Security Advisory for Sensitive Information Disclosure on Some Routers and WiFi Systems, PSV-2020-0449
11/7/2022 Security Advisory for Post-Authentication Buffer Overflow on Some Routers, PSV-2019-0186
11/7/2022 Security Advisory for Post-Authentication Buffer Overflow on Some Routers, PSV-2019-0188
11/7/2022 Security Advisory for Denial of Service on Some Routers, PSV-2019-0215
11/7/2022 Security Advisory for Pre-Authentication Command Injection on Some Routers, PSV-2021-0263
11/7/2022 Security Advisory for Pre-Authentication Buffer Overflow on Some Routers, PSV-2022-0061
11/7/2022 Security Advisory for Sensitive Information Disclosure on Some Routers and Extenders, PSV-2019-0248
11/6/2022 Security Advisory for Pre-Authentication Command Injection on Some Routers, PSV-2021-0338
11/6/2022 Security Advisory for Authentication Bypass on Some Routers and Extenders, PSV-2021-0337
11/6/2022 Security Advisory for Post-Authentication Stack Overflow on Some Routers, PSV-2022-0005
11/6/2022 Security Advisory for Post-Authentication Stack Overflow on XR300, PSV-2022-0140

Cisco publicizes Netgear bugs

If your Netgear Orbi router isn’t patched, you’ll want to change that pronto
by Dan Goodin of Ars Technica   March 22, 2023
The Talos security team (part of Cisco) found four bugs in Netgear routers and within the allotted 90 days Netgear fixed three of them. The remaining bug is hard to exploit. Boring. What's interesting is that two articles referred to remote bad guys exploiting the bugs yet all the descriptions talk about local attacks. So, maybe a bit of hype. Also, Netgear has a hidden Telnet service. Their first attempt to fix one of the bugs was half-assed so it had to be re-done. Bigger picture: Talos found a bug in the RBR750 and said nothing about any other Orbi models. Netgear too, said nothing about any other models. Are we supposed to believe that of the dozen or so Orbi devices only one model had this bug? Really? To me, this is a huge reason to avoid consumer routers.

• Cisco kindly reveals proof of concept attacks for flaws in rival Netgear's kit by Jessica Lyons Hardcastle of The Register. March 22, 2023
• Vulnerability Spotlight: Netgear Orbi router vulnerable to arbitrary command execution by Jonathan Munshaw of Talos. March 21, 2023

Critical bug in Fortinet devices

Fortinet: New FortiOS bug used as zero-day to attack government networks
by Sergiu Gatlan of Bleeping Computer   March 13, 2023
A new FortiOS bug (CVE-2022-41328) had a fix released on March 7th, after the bug had already been exploited in the wild. The attackers are targeting government and large organizations. The bug allowed attackers to execute unauthorized code or commands. Interestingly the attack was noticed when some Fortigate devices shut themselves down after a Firmware Integrity check failed. Some of their devices verify the integrity of system components and they automatically shut down and stop booting to block a network breach, if a compromise is detected. Just three months ago, there was another big flaw in Fortinet devices.

• Fortinet zero-day attacks linked to suspected Chinese hackers by Sergiu Gatlan of Bleeping Computer. March 16, 2023. The attackers could use the malware for cyber-espionage, including data exfiltration, downloading and writing files on compromised devices, or opening remote shells. These were highly targeted attacks against government networks and large organizations. Perhaps the worst part is that the bad guys were intimately familiar with both the FortiGate operating system and the underlying hardware.
• FortiOS - Path traversal in execute command the security advisory from Fortinet. March 7, 2023. Pretty lame as these things go. No details and very short.

FEBRUARY 2023

Aruba devices are a security disaster

Aruba Networks fixes six critical vulnerabilities in ArubaOS
by Bill Toulas of Bleeping Computer   March 1, 2023
I started listing router flaws to convince people not to use consumer grade routers. It turns out that when stepping up, at least to Aruba, the security is no better. Maybe worse. Quoting "Aruba Networks published a security advisory to inform customers about six critical-severity vulnerabilities impacting multiple versions of ArubaOS, its proprietary network operating system." SIX CRITICAL BUGS. Buggy devices can be totally taken over by a remote bad guy. And, all the bugs were all found by one guy. The bugs are in the Aruba Networks access point management protocol, aka the PAPI protocol. Their own protocol. It seems they are not trustworthy. Aruba has released fixes. And, more: several product versions that have reached End of Life (EoL) are also affected by these bugs and will not be patched. Adding insult to injury, the EoL products are also vulnerable to another 15 high-severity and eight medium-severity vulnerabilities. What a s**t show.

• Aruba Product Security Advisory Advisory ID: ARUBA-PSA-2023-002
• Archive of Security Advisories from Aruba

JANUARY 2023

Many Zyxel bugs

Positive Technologies helps fix vulnerabilities in routers and other Zyxel devices
by Positive Technologies February 1, 2023
Zyxel has published some fixes for 4 bugs discovered by Positive Technologies expert Nikita Abramov in several series of Wi-Fi routers. The routers work on 4G and 5G networks. The vulnerabilities affected other Zyxel network devices as well, including optical network terminals, Internet gateways, and Wi-Fi amplifiers. Among the buggy devices:
4G LTE routers: LTE3202-M437, LTE3316-M604, LTE7480-M804, LTE490-M904
5G NR routers: NR5103, NR5103E, NR7101, NR7102, NR7103
Optical network terminals (PM7320-B0 and others)
Internet gateways (EX5510-B0 and others)
Wi-Fi amplifiers (WX3100-T0 and others)
Quoting: "... many buffer overflow vulnerabilities arise from incorrect handling of memory (bad allocation or size calculation) or during the data parsing stage, and the execution of commands becomes possible if certain special characters are not filtered. Such flaws often arise from the negligence of developers or insufficient testing.". Ouch. It is not at all clear if Zyxel ever finished issuing bug fixes for all the vulnerable devices.

• Zyxel security advisory for command injection and buffer overflow vulnerabilities of CPE, fiber ONTs, and WiFi extenders. This was first released January 11, 2023 and never updated. The lack of updates matters because many devices were slated to be fixed in February and April 2023. I am writing this at the end of April and there is no indication these fixes were released. The bugs: CVE-2022-43389, CVE-2022-43390, CVE-2022-43391, CVE-2022-43392

Cisco to their customers: F... Off

Cisco warns of auth bypass bug with public exploit in EoL routers
by Sergiu Gatlan of Bleeping Computer   January 11, 2023
The routers are old, they are buggy and Cisco will not fix them. As the company has done many times before, their solution is for you to buy another router. This bug is in the web-based management interface of the Cisco Small Business RV016, RV042, RV042G, and RV082 routers. The bug is as bad as bad gets, a remote bad guy can get root access to a buggy router. At this point, I wonder if all Cisco routers are buggy. This bug has the same root cause as many of the previous Cisco bugs - improper validation of user input. The bug is CVE-2023-20025 and it was found in by Hou Liuyang of Qihoo 360 Netlab. A work-around is disable remote administration. The article mentions another similar case: that Cisco would not fix a critical flaw in the RV110W, RV130, RV130W, and RV215W EoL routers.

2022

DECEMBER 2022

Security flaw in Netgear routers

Netgear warns users to patch recently fixed WiFi router bug
by Sergiu Gatlan of Bleeping Computer   December 29, 2022
Quoting: "Netgear has fixed a high-severity vulnerability affecting multiple WiFi router models and advised customers to update their devices to the latest available firmware as soon as possible." The buggy devices include the AC and AX Nighthawks. Specifically,models RAX40, RAX35, R6400v2, R6700v3, R6900P, R7000P, R7960P and R8000P. The bug is a pre-authentication buffer overflow, which means it can be exploited without knowing the router password. Neither Netgear nor the article said if it is exploitable from the LAN side, WAN side or both. The article said the bug is simple to exploit and Netgear owners are urged to update their firmware ASAP. Neither Netgear or the article said how the company learned of the flaw. I mention this because the Netgear RAX30 was hacked at the recent PWN2OWN contest (see the Router News page).

• Security Advisory for Pre-Authentication Buffer Overflow on Some Routers, PSV-2019-0208 from Netgear. December 28, 2022

OCTOBER 2022

Even high end devices can have critical bugs

Fortinet warns admins to patch critical auth bypass bug immediately
by Sergiu Gatlan of Bleeping Computer   October 7, 2022
Fortinet has warned their customers of a critical vulnerability in the FortiGate firewalls, FortiProxy web proxies and FortiSwitch Manager (FSWM) management platforms. Bug fixes are available. The bug, CVE-2022-40684, is an authentication bypass in the administrative interface. It allows remote bad guys to log into vulnerable devices. They offer the usual work-arounds for cases where the software can not be updated: limit the source IPs that can access the admin UI or disable remote management entirely.

• FortiOS / FortiProxy / FortiSwitchManager - Authentication bypass on administrative interface from Fortinet. October 10, 2022. They found that a remote bad guy had exploited the bug to download the config file from a buggy device, and to add a malicious super_admin account to it.

SEPTEMBER 2022

Really, I mean it, don't buy Cisco routers

Cisco won’t fix authentication bypass zero-day in EoL routers
by Sergiu Gatlan of BleepingComputer   September 7, 2022
We have seen this exact same thing twice before. Three strikes and you're out. Quoting: "Cisco says that a new authentication bypass flaw affecting multiple small business VPN routers will not be patched because the devices have reached end-of-life (EoL). This zero-day bug (CVE-2022-20923) is caused by a faulty password validation algorithm that attackers could exploit to log into the VPN on vulnerable devices..." Buggy routers are the RV110W, RV130, RV130W, and RV215W. Cisco says to buy a new router. I agree. Any brand but theirs.

• Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers IPSec VPN Server Authentication Bypass Vulnerability a Cisco Security Advisory September 7, 2022

AUGUST 2022

Another wide ranging flaw

Exploit out for critical Realtek flaw affecting many networking devices
by Ionut Ilascu of Bleeping Computer   August 16, 2022
This is a doozy affecting many devices including routers and access points. The bug is the Realtek SDK, specifically the SIP ALG function that rewrites SDP data, which has a stack-based buffer overflow. Bad guys can remotely execute code without authentication, or just crash a vulnerable device. There is no defense on a buggy device and no easy way to tell if a device is vulnerable. The flaw is identified as CVE-2022-27255. Either there is updated firmware or it will be vulnerable forever. Routers with no open ports can be hacked. Routers that do not expose Remote Management can be hacked. Realtek issued a bug fix in March 2022, so devices made afterwards should be safe. The bug was detailed at the DEFCON conference by cybersecurity company Faraday Security. It is unclear how many networking devices use RTL819x chips but the RTL819xD version of the System on a Chip is in products from more than 60 vendors, including ASUSTek, Belkin, Buffalo, D-Link, Edimax, TRENDnet, Zyxel, Tenda, Hikvision, Rockspace, Nexxt, Keo and others. The bug will likely affect routers the most, but some IoT devices may also be affected. Buggy devices run the open-source eCOS operating system which, as these things go, is pretty low end. It has no virtual storage and no concept of privileges. Every thread can access every memory location.

• Realtek SDK Vulnerabilities Exploited in Attacks Days After Disclosure by Eduard Kovacs of Security Week. August 23, 2021.
  Quoting: "IoT Inspector researchers identified more than a dozen vulnerabilities in the SDKs provided by Realtek to companies that use its RTL8xxx chips ... IoT inspector identified nearly 200 unique types of affected devices from a total of 65 different vendors, including routers, IP cameras, Wi-Fi repeaters and residential gateways from companies such as ASUS, Belkin, D-Link, Huawei, LG, Logitech, Netgear, ZTE and Zyxel. The firm estimated that there could be as many as one million systems that are exposed to remote attacks due to these vulnerabilities ..."
• Exploring the hidden attack surface of OEM IoT devices by Faraday. A PDF of their DEFCON slide deck.
• CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow This repository contains the materials for the talk "Exploring the hidden attack surface of OEM IoT devices: pwning thousands of routers with a vulnerability in Realtek’s SDK for eCos OS", which was presented at DEFCON30.
• Realtek AP-Router SDK Advisory (CVE-2022-27255) (pdf) March 25, 2022. No useful information at all.

At this point, you could not pay me to use a Cisco router

Critical flaws found in four Cisco SMB router ranges - for the second time this year
by Simon Sharwood of The Register   August 5, 2022
For the second time this year, Cisco small business routers have critical flaws. Three flaws this time. The buggy models are the RV160, RV260, RV340, and RV345 Series. All three bugs have the same underlying problem, the programmers that work for Cisco are lazy. Put another way, each flaw is due to insufficient input validation. Two of the bugs are critical and a remote bad guy who does not know any passwords can totally take over the routers. Patches are available but the safest approach is to switch router vendors.

• Cisco Small Business RV Series Routers Vulnerabilities from Cisco August 3, 2022

DrayTek routers have a critical flaw

Critical RCE vulnerability impacts 29 models of DrayTek routers
by Bill Toulas of Bleeping Computer   August 4, 2022
This is the second critical security flaw in DrayTek routers that I am aware of. The bug is a Remote Code Execution flaw with a CVSS v3 severity score of 10 (out of 10). In other words, it is as bad as bad gets. Remote attackers can completely take over vulnerable routers. The flaw is a buffer overflow in the web-based management interface. The bug can be exploited both on the WAN/Internet side and on the LAN side. Bug fixes are available.

• Unauthenticated Remote Code Execution in a Wide Range of DrayTek Vigor Routers by Philippe Laulheret of Trellix. August 3, 2022. Quoting: "We also applaud DrayTek for their great responsiveness and the release of a patch less than 30 days after we disclosed the vulnerability to their security team."
• DrayTek Router unauthenticated remote code execution vulnerability (CVE-2022-32548) by DrayTek August 4, 2022

JULY 2022

Arris bugs show the company's true personality

Arris / Arris-variant DSL/Fiber router critical vulnerability exposure
by Derek Abdine   July 29, 2022
There are three different bugs in muhttpd software that runs the web administration portal. One of the bugs is critical, two are somewhat impractical to exploit. The buggy muhttpd software is used in both Arris router products and whitelabel/OEM products by other vendors. The bug has been confirmed in Arris router models NVG443, NVG599, NVG589, NVG510, as well as ISP-customized variants such as BGW210 and BGW320. Here is the bigger issue: "The complete list of affected products is unknown as Arris has declined to comment on the affected product list." Lesson learned, we don't want any products from Arris. The most severe vulnerability allows unauthenticated path traversal from the root of the file system as the root user. This exposes a whole host of sensitive information. The muhttpd software was patched in June 2022. Prior to that the last release of the software was in 2010. Arris is content to use software that had not been updated in 12 years. The path traversal bug appears to be present in the initial release of the muhttpd software in 2006. If the web portal is not available on the WAN side, the critical bug can not be exploited remotely. However, it can still be exploited on the LAN side. This is another reason for VLANs, as it lets us limited which devices can see the router on the LAN side. The Security Checklist page lists some other LAN side protections that block users/devices from getting at the router.

JUNE 2022

Throw away old Cisco small business routers

If you're using older, vulnerable Cisco small biz routers, throw them out
by Jessica Lyons Hardcastle of The Register   June 16, 2022
Cisco can not be shamed into fixing old buggy routers. A critical vulnerability exists in the web-based management interface of the Cisco RV110W, RV130, RV130W, and RV215W routers, These models went End of Life back in 2019. The bug is CVE-2022-20825 and it is due to insufficient user input validation of incoming HTTP packets. In other words, lazy programmers. In addition, there is a critical vulnerability in Cisco enterprise security appliances that could allow a remote bad guy to log in to the web management interface. This bug they will fix.

• Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability by Cisco June 15, 2022

MAY 2022

Well, this is new

Two business-grade Netgear VPN routers have security vulnerabilities that can't be fixed
by Zeljka Zorz of Help Net Security   May 20, 2022
Quoting: "Netgear has admitted that multiple security vulnerabilities in its business-grade BR200 and BR500 VPN routers can't be fixed due to technical limitations outside of their control, and is offering users a free or discounted replacement router." Netgear does not offer details of the vulnerabilities, which were reported by Joel St. John of IncludeSecurity. To exploit the bug(s) the router administrator would have to be logged on to the router while they visited a malicious website. Advice about this has been on the home page of this website for years.

• Security Advisory for Multiple Security Vulnerabilities on BR200 and BR500, PSV-2021-0286 from Netgear. May 19, 2022.

Paying lots of money does not get you security

Hackers are exploiting critical bug in Zyxel firewalls and VPNs
by Ionut Ilascu of BleepingComputer   May 15, 2022
Jake Baines of Rapid7 discovered a bug in assorted Zyxel devices. Fixes are available. The bug was serious enough that the NSA warned Zyxel customers to patch immediately. These devices are supposed to provide security. The bug is CVE-2022-30525 and the buggy devices are the USG FLEX series, the ATP series, and the USG20-VPN/USG20w-VPN. The bug lets bads guys inject arbitrary commands remotely without authentication. One thing bad guys can do with this is to set up a reverse shell. The bug was due to un-sanitized URI input (sound familiar?) being fed into the os.system method. Rapid7 reported that there are over 15,000 vulnerable devices online. Shadowserver found over 20,000 Zyxel firewall models on the Internet that are potentially affected by the bug.

• CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection by Jake Baines of Rapid7. May 12, 2022

APRIL 2022

Yet another buggy router

Security audit of the SKYWORTH GN542VF router – how to hack the admin panel password without leaving the web browser!
by Alexey Miloserdov   April 5, 2022
The router is somewhat unusual. Each one ships with a unique password. The password is displayed on the login web page, but only if you are on the LAN side, not when you login from the WAN side. When someone logs in with the correct password from the WAN side, the router shows an error message. Sounds good, at first. However, the password is always in the login page and it is only hidden using JavaScript that can be easily manipulated with developer tools built into the web browser. And, while it does display an error when someone logs in from the WAN side, it nonetheless logs the person in. The error message is a scam. I don't know what country or ISP uses this router.

MARCH 2022

You can't make this up - another Zyxel critical bug

Zyxel urges customers to patch critical firewall bypass vulnerability
by Charlie Osborne, of ZDNet   April 1, 2022
A critical vulnerability in Zyxel firewall software has just been fixed. Buggy devices include their USG, ZyWALL, USG FLEX, ATP, VPN and NSG. The company has fixed "products that are within their warranty and support period" and did not say anything about older devices that may also be vulnerable. The bug is due to "the lack of a proper access control mechanism". Words with no meaning. The bug lets a bad guy bypass authentication and obtain administrative access. In other words, it is as bad as bad gets. Bug is CVE-2022-0342.

• Zyxel security advisory for authentication bypass vulnerability of firewalls from Zyxel. March 29, 2022

FEBRUARY 2022

Many Zyxel routers are buggy as heck

Multiple Critical Vulnerabilities in multiple Zyxel devices
by G. Hechenberger, S. Robertz, S. Viehböck and T. Weber of SEC Consult   February 15, 2022
"Multiple Zyxel devices are prone to different critical vulnerabilities resulting from insecure coding practices and insecure configuration." All told, SEC Consult found eight different types of bugs. The bugs included: multiple unauthenticated buffer overflows, two unauthenticated Local File Disclosures (which lets bad guys read all files), Unsafe Storage of Sensitive Data and a couple command injection flaws. Not enough? They also found that Zyxel fails to use OS level protection mechanisms like PIE, stack canaries and relocation read only. SEC Consult offered no workarounds (really?). They also failed to say which, if any of the bugs can be exploited from the WAN side as those are obviously more dangerous than bugs that are exploitable from the LAN side only. There are fixes for some, not all devices. Many devices will not be fixed as they are too old to bother with (EoL). Some other devices will get their bug fixes in September 2022. The timeline shows that Zyxel took over a year before they issued fixes. I am told that Zyxel consumer routers are popular in Europe, especially in the UK. The UK popularity stems from their use of BroadCom chipsets that provide a very stable VDSL2 connection over old copper wire that is prone to line noise.

• Zyxel security advisory for multiple vulnerabilities The list of buggy devices from Zyxel. Undated. Of course. We don't need no stinking dates.

Yet again, critical security flaws in Cisco routers

Cisco inferno: Networking giant reveals three 10/10 rated critical router bugs
by Simon Sharwood of The Register   February 4, 2022
Cisco reminds me of the Wizard of Oz. Seemingly great and powerful on the outside, but inside a dumpster fire of disgracefully buggy software. The buggy hardware this time are the RV160, RV260, RV340 and RV345 products. Cisco revealed that there are 15 bugs, but a handful are brutal - as bad as bad gets. Some of the bugs are fixed, but not all.

• Critical Cisco Bugs Open VPN Routers to Cyberattacks by Tara Seals for ThreatPost. Feb 3, 2022
• Cisco Small Business RV Series Routers Vulnerabilities from Cisco Feb 4,2022

JANUARY 2022

Here we go again, another bug in NetUSB affects many routers

Millions of Wi-Fi routers vulnerable to hacker attack — what you need to do
by Paul Wagenseil of Toms Guide   January 11, 2022
Consumer routers are buggy enough without also expecting them to share assorted devices plugged into their USB ports. Software that enables this sharing, NetUSB, was found to be buggy back in May 2015. NetUSB is used in many routers. Which ones? None of your business. Back in 2015, there were 26 router vendors thought to be using NetUSB. Sometimes NetUSB can be disabled via the router web interface, sometimes not. This bug is a buffer overflow and, fortunately, is hard to exploit. NetUSB opens port 20005 on the LAN side of the router. Perhaps most worrying is that some routers are double buggy and open port 20005 on the WAN/Internet side also. If so, the router can be sent commands directly, NetUSB does not do authentication. The creator of NetUSB, KCodes, was told of the buffer over-run on Sept. 9, 2021, and a patch was issued on Oct. 4th. Netgear routers, the D7800, R6400v2 and R6700v3 were patched on Dec. 20, 2021. Other vendors that license NetUSB, Edimax, D-Link, Tenda, TP-Link and Western Digital have done nothing. D-Link is looking into it. Great reason to avoid TP-Link.

• Home routers with NetUSB support could have critical kernel hole by Paul Ducklin for Naked Security Jan. 11, 2022
• CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers by Max Van Amerongen of Sentinel Labs Jan. 11, 2022
• You can test if a router has port 20005 open on the WAN side at www.grc.com/x/portprobe=20005

2021

DECEMBER 2021

Bugs in the Netgear Nighthawk RAX43

Netgear Nighthawk RAX43 Multiple Vulnerabilities
by Evan Grant, Jimi Sebree of Tenable   December 30, 2021
The bugs are in firmware version 1.0.3.96 which was the latest as of December 28, 2021. This article is dated the 30th and Netgear claims to have released new firmware on the 29th. Just like the below group of bugs with the R6700, some of which were fixed in 90 days. What bugs did Netgear fix? None of your business. Not what you want in a router vendor. Like the R6700, this router also uses HTTP by default for its web interface, saves passwords in plain text, includes old buggy jQuery libraries, includes a vulnerable version of the minidlna service and has insufficient UART protection mechanisms. But, that's not all. Configuration backups are encrypted with a hard-coded password (RAX50w!a4udk). And two bugs can be combined. The first is a buffer overrun, the second, command injection. Together someone can perform remote tasks as root, without authentication. As with the Tenable report below, this one too, does not make it clear which, if any, bugs can be exploited from the WAN side and under what circumstances.

• Security Advisory for Multiple Vulnerabilities on Some Routers, PSV-2021-0279 from Netgear. New firmware version 1.0.5.106 is available for the RAX43. No details at all. December 29, 2021.

Bugs in the Nighthawk R6700 that Netgear handles poorly

Netgear leaves vulnerabilities unpatched in Nighthawk router
by Bill Toulas of Bleeping Computer   December 31, 2021
Cybersecurity company Tenable found six high-risk vulnerabilities in the latest firmware version (1.0.4.120) for the Netgear Nighthawk R6700v3 router. They notified Netgear of the bugs on Sept 30, 2021 and by Dec 30th had heard nothing back from Netgear about any possible fixes. So, they went public with the details. Not what you want from your router vendor. The bugs could let an attacker on the LAN side take complete control of the router. The danger from the WAN side is not clear. One easily understood issue is that insecure HTTP is used by default on communications to/from the device’s web interface. Also, passwords are stored in plain text. In addition to the six bugs, Tenable also found instances of a common problem with routers - the firmware includes old software with known bugs. Specifically, they found several instances of jQuery libraries relying on version 1.4.2 and they found an old buggy version of the MiniDLNA server software. Taking a step back, hardware versions 1 and 2 of this router are too old to fix (End of Life is the official buzzword) so Tenable only examined hardware version 3. Interesting wrinkle, Netgear released a new firmware for this router pretty much at the same time as Tenable went public with the bugs. What did Netgear fix? None of your business. Not what you want from your router vendor.

• Security Advisory for Multiple Vulnerabilities on Some Routers, PSV-2021-0279 from Netgear. New firmware version 1.0.4.122 is available. No details at all. December 29, 2021.
• Netgear Nighthawk R6700 Multiple Vulnerabilities Tenable Advisory ID: TRA-2021-57 by Jimi Sebree December 30, 2021

Consumer routers prove my point, yet again

Nine WiFi routers used by millions were vulnerable to 226 flaws
by Bill Toulas of Bleeping Computer   December 2, 2021
This is not the first time an examination of multiple routers has found a huge number of bugs. In this case, nine routers yielded 226 bugs. All were current models running the latest firmware. The routers were from Asus, AVM, D-Link, Netgear, Edimax, TP-Link, Synology, and Linksys. The automated system used to find these bugs only looks for known flaws. The underlying issue is old software that is not upgraded when fixes are made. The TP-Link Archer AX6000 was the worst router, with 32 flaws. The Synology RT-2600ac, which I hated, had 30 bugs. The best router had 18 bugs. The research was done by IoT Inspector, in collaboration with German IT magazine CHIP. They also found a way to send malicious firmware to the D-Link DIR-X1560. Most of the reported bugs have been fixed. Not said, is whether the fixes were for the one tested model or for all similar models. No one ever dwells on that. Also, the fixes were not tested to insure they really fix the problems.

• Hackers welcome: Major security test uncovers vulnerabilities in all common Wi-Fi routers by IoT Inspector December 2, 2021
• Your expensive Wi-Fi router probably has security flaws - here's what to do by Paul Wagenseil for Toms Guide December 2, 2021

Netgear again

Thousands of Netgear Wi-Fi routers need to be patched now - here's how
by Paul Wagenseil of Toms Guide   December 3, 2021
I think Paul is re-using his headlines at this point :-) Not the biggest flaws in the world. What stands out to me is that the bugs were first disclosed to Netgear on May 3, 2021. Long time ago. Buggy devices include 35 different models of routers, Wi-Fi range extenders and combination modem-routers. The bugs were found by British security firm Immersive Labs.

• Netgear vulnerabilities could put small business routers at risk by Kev Breen of Immersive Labs. The original report. December 2, 2021
• Netgear router flaws exploitable with authentication ... like the default creds on Netgear's website by Gareth Corfield of The Register December 3, 2021

NOVEMBER 2021

If there was ever a case to be made about not using an ISP router, this is it

Six million Sky routers had serious security flaw
by Jane Wakefield of the BBC   November 19, 2021
Quoting: "About six million Sky routers had a significant software bug that could have allowed hackers to take over home networks ... The problem has been fixed - but researchers say it took Sky 18 months to address.". Sky is one of the biggest ISPs in the U.K. The bug was in four Sky Hub models and 2 Booster models. The problem was with DNS rebinding and a malicious web page, anywhere on the Internet, could exploit the flaw. Most of these routers shipped with a default password which is never good. Better routers make you pick a new password at first boot. Anyone who changed the password was safe. It is not clear to me, after reading the report, if changing the internal IP address of the router offers protection from this attack. Final insult: Sky would not maintain communication with the company that found and reported the flaw, Pen Test Partners.

• SkyFail. 6 million routers left exposed by Rafael Fini of Pen Test partners. November 19, 2021. The original research.

Still more Netgear bugs

Netgear patches severe pre-auth RCE in 61 router and modem models
by Catalin Cimpanu of The Record   November 17, 2021
A bug with UPnP lets devices connected to the router hack the router without knowing the password. A LAN side device can get Remote Code Execution as root on a buggy router. Perhaps most importantly, this is the fifth major set of remote code execution bugs that Netgear has needed to patch this year. Other remote takeover bugs were found in March (by NCC Group), June (by Microsoft), September (by Polish security researcher Gynvael Coldwind) and also in September (by GRIMM). One defense, not mentioned in the article, is to limit the LAN side devices that can communicate with the router. This is always a good idea. On some of the buggy routers, the bug an not be exploited. Why not? The fix for an earlier bug broke the UPnP SUBSCRIBE and UNSUBSCRIBE functions. Netgear fixed the latest bug in some of their routers but old ones (EoL or End of Life) were not fixed.

• Seamlessly Discovering Netgear Universal Plug-and-Pwn (UPnP) 0-days by Adam from GRIMM November 16, 2021. The original research.

Routers are sitting ducks for hackers

PWN2OWN Austin 2021
by Dustin Childs of Zero Day Initiative   November 1, 2021
Three routers were targeted at a recent hacking contest and they all were successfully hacked.

The Cisco RV340 router was successfully attacked three times from the WAN/Internet side and six times from the LAN side. A software cesspool, it is. In the very definition of irony, the web page for the RV340 says "Connect Your Network Safely and Securely" Ha.

1. An attacker used a logic error to compromise the WAN interface
2. An attacker used an impressive stack-based buffer overflow to get code execution on the WAN interface
3. An attacker used a unique command injection bug to takeover the Cisco RV340 from the WAN interface
4. An attacker used a three-bug exploit chain to hack the LAN interface
5. An attacker used a four-bug exploit chain, including some known bugs to hack the LAN side
6. An attacker used four bugs to exploit the Cisco RV340 router via the LAN interface
7. An attacker used three unique bugs, including an authorization bypass and a command injection, to get code execution on the LAN interface
8. An attacker used a three-bug chain, including an authorization bypass and a command injection, to take over the LAN interface
9. An attacker leveraged 4 bugs on the LAN interface, but some of the bugs had been seen earlier in the conference.

The TP-Link AC1750 router was successfully hacked three times.

1. An attacker used an Out-Of-Bounds (OOB) Read to get a root shell via the LAN interface
2. Another attacker also used an OOB Read bug to take control of the router via the LAN interface
3. An attacker exploited the LAN interface of the router using a known bug that has not yet been fixed

The Netgear Nighthawk R6700 v3 Smart WiFi Router (AC1750) was hacked seven times, once from the WAN side, six times from the LAN side. The home page for the R6700 brags about Speed, Wi-Fi range and Reliability. Nothing about security. So, better than Cisco.

1. An attacker used an integer overflow to gain code execution on the LAN interface
2. An attacker used an authorization bypass with a command injection bug to get code execution on the LAN side
3. An attacker combined a heap overflow and a stack-based buffer overflow to gain code execution on the LAN interface
4. An attacker used an uninitialized variable to get a root shell via the LAN interface
5. An attacker used an improper certificate validation and a stack-based buffer overflow to compromise the router via the WAN interface
6. A attacker two bugs to exploit the router, but the path traversal bug was only an N-day
7. An attacker used a pair of bugs to execute code via the LAN interface

• How We Hacked a TP-Link Router and Took Home $55.000 in Pwn2Own a video

SEPTEMBER 2021

SonicWall has holes in its wall

SonicWall warns users to patch critical vulnerability as soon as possible
by Pieter Arntz of MalwareBytes   September 24, 2021
SonicWall specializes in securing networks but a critical bug makes them less secure. The bug is in the SMA 100 series of devices, specifically the SMA 100, 200, 210, 400, 410, and 500v. Details: "... the vulnerability is an improper access control ... [that] allows a remote unauthenticated attacker to bypass path traversal checks and delete an arbitrary file. Which, if the attacker knows what they are doing, can potentially result in a reboot to factory default settings. With the default settings in place the attacker can gain administrator privileges by using the factory default credentials." Patches are available. The patches also include fixes for two other less critical bugs, a local privilege escalation flaw, and a denial-of-service vulnerability.

• Security Notice: Critical Arbitrary File Delete Vulnerability In SonicWall SMA 100 Series Appliances from SonicWall Sept 24, 2021

Fixes available for buggy Netgear routers

Netgear fixes dangerous code execution bug in multiple routers
by Sergiu Gatlan of Bleeping Computer   September 21, 2021
Adam Nichols of GRIMM discovered a bug in the Circle parental control service on these Netgear routers: R6400, R6700, R6900, R7850, R7900, R8000 and RS400. If you have a Netgear router, beware of their marketing. Paul Wagenseil warns "Because Netgear markets its home routers using somewhat misleading terminology - for example, the R7000 is also labeled as the 'Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router' - you might want to flip your router over and check the sticker on the bottom for the real model name." If the Circle software is installed, the router is vulnerable. The bug is in the Circle update routine which runs as root. Wagenseil offers perspective on this: "The problem is in the Disney-designed Circle parental-control feature, which was rolled out to Netgear Nighthawk and Orbi mesh routers in 2017. The Orbis and newer Wi-Fi 6 Nighthawks got parental-control software built in-house by Netgear earlier this year, while the Circle service was discontinued for older Nighthawk models in late 2020." Updated firmware is available, but there are many steps to the manual update process. The bug is relatively hard to exploit as the bad guy must be must be able to intercept and modify the router's network traffic. Gatlan points out that earlier this month, Netgear fixed three severe security vulnerabilities impacting over a dozen of their smart switches, allowing bad guys to take over unpatched devices.

• Thousands of Netgear routers can be hacked - here's what to do by Paul Wagenseil of Toms Guide September 21, 2021. Quoting: "Netgear's consistent policy of finding, patching and publicizing its security flaws is a Good Thing, despite the resulting negative headlines. The only reason you don't hear about many security flaws with some other major router makers is because they don't tell you about the flaws. At least we know when something goes wrong with Netgear routers and how to fix it." The flip side is that the researchers tried three times unsuccessfully to contact Netgear. They had to get CISA involved.
• Mama Always Told Me Not to Trust Strangers without Certificates by Adam of GRIMM September 21, 2021

For two years, Virgin Media fails to fix a router bug

VPN users unmasked by zero-day vulnerability in Virgin Media routers
by Adam Bannister of Port Swigger   September 20, 2021
Fidus Information Security, a UK penetration testing consultancy discovered a flaw in the Virgin Media Super Hub 3 router and reported it in October 2019. In February 2020 Fidus was asked not to publicly reveal the flaw until the first quarter of 2021. They agreed. Suckers. Virgin Media, and parent company Liberty Global, both stopped responding to Fidus. As of the end of September 2021, the bug is still not fixed. The flaw is that the router will reveal the public IP address to anyone on the LAN side that knows how to ask for it. To exploit this, Fidus uses DNS rebinding along with a malicious DNS server for a malicious domain. Load a web page from that domain, and it can reveal the public IP address even when a VPN is being used. Not all VPNs, but many. Some do not allow access to LAN side devices, some do. A good VPN will offer a choice as there is no one right answer. The tested router is really the ARRIS TG2492 and Fidus believes the vulnerability probably works against all related models. Don't hold your breath for a comment from Arris.

• Virgin Media Routers Left VPN Users Vulnerable Since at Least 2019 by Nathaniel Mott for PC Magazine September 20, 2021
• Silently Unmasking Virgin Media VPN Users in Seconds (CVE-2019-16651) by Fidus Information Security. This is the original research March 22, 2021

One TP-Link router is buggy as heck. What about others?

"Amazon’s Choice" best-selling TP-Link router ships with vulnerable firmware
by Edvardas Mikalauskas of CyberNews.com   September 2, 2021
The bugs in this one router model are not important. What is important is that, no doubt, many other TP-Link routers share these bugs and only this one model will be fixed. TP-Link is hugely popular, the article reports they sell over 150 million devices annually. The article is about the TP-Link AC1200 Archer C50 (v6) router. On Amazon it is rated 4.5 stars (out of 5) with over 61,000 ratings. Just shows how security is not a concern. The article covers many bases. For one: "The router is shipped with outdated firmware that is vulnerable to dozens of known security flaws". Then too: "The default version of the router's web interface app suffers from multiple bad security practices and vulnerabilities, including clickjacking, charset mismatch, cookie slack, private IP disclosures, weak HTTPS encryption, and more." They list 13 different issues with the web interface which is surely shared by many TP-Link routers. There were other security problems too. As for known bugs in the shipping firmware, some of these are fixed in later versions of the firmware, however the router does not auto-update. The researchers said that TP-Link responded quickly and plans on force-feeding the router a firmware update. As for the rest of the many TP-Link routers, this was not discussed. Par for the course.

• Hackers Reveal How This Popular Wi-Fi Router Packed An Unwanted Security Surprise by Davey Winder in Forbes. Sept. 4, 2021. Quoting: "... this will be far from the only manufacturer shipping older routers with outdated and vulnerable firmware. That's a given, just as most consumers, and many business users, have no real idea that their routers could be a security threat..."

AUGUST 2021

How low can Cisco go? Pretty low.

Cisco says it will not release software update for critical 0-day in EOL VPN routers
by Jonathan Greig of ZDNet   August 27, 2021
Cisco to their customers: Yeah, it's a bug, but we are not going to bother fixing it because the routers are old. Go buy a new router.
Yet again, Cisco has been caught failing to validate input. Lazy, lazy, lazy. Again, again, again. This vulnerability is in the Universal Plug-and-Play (UPnP) service in their Small Business RV110W, RV130, RV130W, and RV215W routers. An unauthenticated attacker can execute arbitrary code or cause a vulnerable device to restart unexpectedly. The support page for the RV215W router says that the end of support date is November 30, 2024. Seems like they lied. And the links for EOL of the RV215W go here which says nothing at all about the RV215W. Cisco is really bad news.

• Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability by Cisco August 18, 2021.

More bugs that will never be fixed

Remote code execution flaws lurk in countless routers, IoT gear, cameras using Realtek Wi-Fi module SDKs
by Thomas Claburn of The Register   August 16, 2021
There are vulnerabilities in three Realtek SDKs accompanying its Wi-Fi modules. This article says there are 4 bugs, the original report lists a dozen. The hardware is used in almost 200 products made by more than 65 vendors. Vendors selling the buggy hardware include: AsusTEK, Amped Wireless, Belkin, Buffalo, D-Link (many devices), Edimax, EnGenius, Huawei, Logitech, Netis, Technicolor, Tenda, TRENDnet, Zyxel and Netgear. The flaws require an attacker to be on the same network as the vulnerable device, or be able to reach it over the Internet. It is not clear if a VLAN offers any protection. Remote unauthenticated attackers (the worst kind) can fully compromise a device and execute code with the highest level of privilege. One buggy device, the Realtek RTL819xD module, creates wireless access points. One estimate is that almost a million vulnerable devices may use the buggy software, including VoIP and wireless routers, repeaters, IP cameras, and smart lighting controls. Realtek will fix some of the bugs, others are in software that is too old to bother with. However, it is expected that most vulnerable devices will never be patched.

• Advisory: Multiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain by Iot-Inspector.com August 16, 2021. Original source. The article has a long list of known buggy devices. "Supported by IoT Inspector’s firmware analysis platform, we performed vulnerability research ... and identified more than a dozen vulnerabilities – ranging from command injection to memory corruption affecting UPnP, HTTP (management web interface), and a custom network service from Realtek." Buggy devices "cover a wide spectrum of use cases: from residential gateways, travel routers, Wi-Fi repeaters, IP cameras to smart lightning gateways or even connected toys". This is a pretty good showcase of the vast implications of an obscure IoT supply chain. There is lots of blame to go around:
  Realtek bad: "...insufficient secure software development practices, in particular [a] lack of security testing and code review, resulted in dozens of critical security issues to remain untouched in Realtek’s codebase for more than a decade...".
  Hardware vendors bad: "manufacturers with access to the Realtek source code ... [failed] to sufficiently validate their supply chain, left the issues unspotted and distributed the vulnerabilities to hundreds of thousands of end customers – leaving them vulnerable to attacks." Then too, even when a hardware vendor fixed a bug, it was never reported back to Realtek so everyone else using the same software remained vulnerable.
• Hundreds of thousands of Realtek-based devices under attack from IoT botnet by Catalin Cimpanu for The Record August 23, 2021. The bad guys know about the bugs and are trying to exploit them.
• Realtek Security Flaw August 16, 2021. Peplink does not use Realtek hardware in their routers.

Fortinet falls down

Fortinet delays patching zero-day allowing remote server takeover
by Sergiu Gatlan of Bleeping Computer   August 17, 2021
This is interesting, to me, not because of the delay in patching that is the focus of the article. Instead, I take note the long list of security bugs in Fortinet software that is cited at the end of the article. It's pretty long. And, the fact that Fortinet clammed up and stopped responding to Rapid7 which found the latest bug. That is not acceptable.

Cisco bugs never cease. They are as inevitable as death and taxes

Cisco fixes critical, high severity pre-auth flaws in VPN routers
by Sergiu Gatlan of Bleeping Computer   August 4, 2021
The web-based interface of these Cisco routers are buggy: RV340, RV340W, RV345, RV345P (Dual WAN Gigabit VPN routers), RV160, RV160W, RV260, RV260P, and RV260W (VPN routers). Yet again, the underlying problem is improperly validated HTTP requests and insufficient user input validation. Yet again. If remote access is disabled, then buggy devices are safe on the WAN side. There is no protection at all on the LAN side (the web interface can not be disabled), so the existing patches should be installed ASAP. There are two bugs. Attackers without the password can trigger a denial of service condition or execute commands and arbitrary code.

• Critical Cisco Bug in VPN Routers Allows Remote Takeover by Tara Seals for ThreatPost August 6, 2021
• CVE-2021-1609: Critical Remote Code Execution Vulnerability in Cisco Small Business VPN Routers by Satnam Narang of Tenable August 5, 2021

Yet another widespread router flaw

Decade-long vulnerability in multiple routers could allow network compromise
by Jessica Haworth of Port Swigger   August 4, 2021
Evan Grant of Tenable discovered an authentication bypass vulnerability in many routers and modem/routers manufactured by Arcadyan. The bug exists in at least 20 router models from 17 different vendors including Asus, Verizon, Vodafone, British Telecom, O2 (Telefonica), Orange, Hughesnet, Deutsche Telekom, Telstra and Telus. Was your router made by Arcadyan? None of the articles mentioned how you can tell. I have recent photos of a Verizon FIOS G3100 router and it certainly does not say Arcadyan anywhere on the outside. The important lesson here for consumer routers is that the vendor selling you the device is not necessarily the one who manufactured it. Grant also found two separate flaws in some Buffalo routers. This was the first time Grant had looked at a router for bugs and he said the flaws were "fairly easy to discover" and "trivial to exploit" The widespread bug is a path traversal flaw and is assigned CVE-2021–20090. The bug has been around for at least 12 years and can be exploited by unauthenticated, remote attackers. What is not said is whether the flaw can be exploited on routers that have Remote Administration turned off. My guess is no and that this fact was left out to make the bug seem more important. That said, I recently used a Verizon FIOS G3100 router and the user interface for Remote Administration was so miserably confusing I could not tell if I was turning it on or off.
UPDATE: Aug 25, 2021. I am told by a Verizon FIOS customer that there is new firmware, version 3.1.0.12, for the G3100 Router. The router self-updates. According to Joshua Lowcock it only self-updates, but he documented a work-around to force an update. What changes are in this new release? None of your business, Verizon does not seem to keep a change log. However, the GUI for the Admin interface has changed dramatically, which can only be a good thing. Lowcock notes that the new firmware has a dedicated wireless network for IoT, offers control over each wifi antenna and has a new performance-mode tri-band setting. Nothing about a security bug fix. Way back when, Verizon kept using WEP a decade after it was known to be insecure, so I would not get my hopes up about bug fixes.

• Millions of home Wi-Fi routers under attack by botnet malware - what you need to know by Paul Wagenseil. Last updated Aug 11, 2021. Has great information for Verizon FIOS customers.
• Who or what is Arcadyan. They seem like they don't exist at all. Their website not secure. The latest news on their home page is from 2019. After some contact from Tenable about the bug, they just stopped responding. You do not want to every use a router made by them.
• Bypassing Authentication on Arcadyan Routers with CVE-2021–20090 and rooting some Buffalo by Evan Grant in Medium August 3, 2021. This article has the gory techie details on the bugs and how they were found
• Arcadyan-based routers and modems vulnerable to authentication bypass CERT Vulnerability Note VU#914124 Last Revised: Aug 4, 2021.
• Multiple Vulnerabilities in Buffalo and Arcadyan manufactured routers by Evan Grant of Tenable. This lists all the buggy routers that have been found, so far.
• Home routers are being hijacked using vulnerability disclosed just 2 days ago by Pieter Arntz of MalwareBytes August 9, 2021
• www.verizon.com/routersupport Says nothing about this flaw. I poked around the Verizon site and Forum for a bit and could not find a firmware release history for the FIOS G3100.
• Vulnerability Affecting Routers From Many Vendors Exploited Days After Disclosure by Eduard Kovacs in Security Week. August 9, 2021.

JULY 2021

Bugs in a D-Link router. Just one model? None of your business

D-Link issues hotfix for hard-coded password router vulnerabilities.
by Sergiu Gatlan of Bleeping Computer   July 16, 2021
If hard code password backdoors do not turn you off D-Link, nothing will. A guy at Cisco, Dave McDaniel, took a look at the DIR-3040 router and found it to be a security nightmare. Multiple vulnerabilities: command injection, information disclosure and the biggie - executing arbitrary code. I am not surprised. I am also not surprised that the original report from Cisco and the article about it from Bleeping Computer focus exclusively on the DIR-3040. So too does D-Link. This is disgraceful. What about other similar routers with similar firmware? Clearly, that is none of our business. What should someone with a DIR-2640 or DIR-1950 do? Router vendors share firmware across multiple models. It is all but guaranteed that similar models have the same bugs. Anyone using a D-Link router clearly does not care about security. Still, Cisco says the bugs were fixed on July 13th but D-Link says on June 9th. Beats me.

• Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040 by Jon Munshaw of Cisco July 15, 2021
• DIR 3040 router home page. It sells for about $160. No mention of these critical bugs. Of course not.
• Downloads for the DIR-3030 from D-Link. The latest firmware is from August 2020. You have to know that a hotfix takes precedence over firmware, something consumers probably do not know. And why are there two hotfixes? I'm confused.
• DIR-3040 :: Rev. Ax :: FW v1.13B03 :: CVE-2021-21816 / CVE-2021-21817 / CVE-2021-21818 / CVE-2021-21819 / CVE-2021-21820 -Multiple Vulnerabilities from D-Link. The title says it all. Undated (of course)

A bad Summer for SonicWall

Another Brick in the Wall: eCrime Groups Leverage SonicWall VPN Vulnerability
by Heather Smith and Hanno Heinrichs of Crowdstrike   June 8, 2021
There was a bug, SonicWall did not fix it completely and eventually bad guys exploited the heck out of it. Quoting Pieter Arntz: "In the continuous wave of ransomware attacks you may have noticed a trend where the software and devices that are designed to keep you safe, are being used to establish the opposite. This year we have seen Pulse Secure vulnerabilities exploited in the wild, CISA warnings about successful attacks targeting a number of years-old vulnerabilities, and the colossal Kaseya supply-chain attack, among others."

• Security Advisory: SonicOS Vulnerability In Firewall Web Management Interface by SonicWall June 15, 2021. "... certain versions of SonicOS may contain a vulnerability that could be leveraged for an unauthenticated Denial-of-Service (DoS) attack by sending a specially crafted POST request to the web interface."
• Analyzing SonicWall's Unsuccessful Fix for CVE-2020-5135 by Craig Young of Tripwire June 22, 2021. Very slow response from SonicWall
• SonicWall 'Botches' October Patch for VPN Bug by Elizabeth Montalbano of ThreatPost June 23, 2021. An October patch for a critical bug in a SonicWall VPN appliance turned out to be insufficient. This left more than 800,000 devices vulnerable to an additional memory-leak flaw for months.
• SonicWall warns users of 'imminent ransomware campaign' by Pieter Arntz of Malwarebytes July 15, 2021
• Urgent Security Notice: Critical Risk To Unpatched End-Of-Life SRA & SMA 8.X Remote Access Devices from SonicWall July 15, 2021. Bad guys are actively targeting SMA 100 series and SRA products running unpatched and end-of-life 8.x firmware in an imminent ransomware campaign using stolen credentials.
• SonicWall Warns Secure VPN Hardware Bugs Under Attack by Tom Spring of ThreatPost July 15, 2021

JUNE 2021

Multiple Zyxel devices vulnerable to WAN side attack

Sophisticated hackers are targeting these Zyxel firewalls and VPNs
by Liam Tung of ZDNet   June 25, 2021
Bad guys are hacking into these Zyxel devices: Unified Security Gateway (USG), ZyWALL, the USG FLEX combined firewall and VPN gateway, Advanced Threat Protection firewalls, and VPN series devices. They are modifying the devices to gain entry into the network behind them. The official Zyxel response makes it sound as if the bad guys are abusing back door accounts built into the devices. If so, it would not be the first time. Earlier this year, researchers found a backdoor account in Zyxel firmware, which left 100,000 devices vulnerable.

• Hackers are using unknown user accounts to target Zyxel firewalls and VPNs by Dan Goodin of Ars Technica June 24, 2021
• Security Vulnerability Alert and Firmware Patches by Tobias Hermanns of Zyxel July 6, 2021. Updates are available

Microsoft toots their own horn - finds bug in 10 year old Netgear consumer router

Microsoft finds new NETGEAR firmware vulnerabilities that could lead to identity theft and full system compromise
by Jonathan Bar Or of Microsoft 365 Defender Research Team   June 30, 2021
The buggy router, the NETGEAR DGN-2200 v1 series is really a combination modem/router. And, it is old as heck, the User Guide is dated February 2011. Yet, here we are, in June 2021 and Microsoft announces that they found bugs in it. This is really a PR stunt for Microsoft defensive software. That said, their software was triggered by "... a device owned by a non-IT personnel was trying to access a NETGEAR DGN-2200v1 router’s management port." Great catch, but who is using a 10 year old DSL modem/router and the latest and greatest Microsoft software? The router is as buggy as buggy gets. Any remote person can get full control of it. The worst bug lets you access any page in the web admin if you include one of the get-out-of-jail-free character strings in the GET request. Another bug exploits the encryption of the configuration backup file to learn the userid/password to login legitimately. The bugs are described in enough details to make someone not trust Netgear. The bugs have been fixed, which is quite a trick. You have to assume this router was End-of-Life years ago.

• Security Advisory for Multiple HTTPd Authentication Vulnerabilities on DGN2200v1 from Netgear. First published Dec. 15, 2020

MAY 2021

Wi-Fi bugs in most every Wi-Fi device

Frag Attack
by Mathy Vanhoef of NYU   May 10, 2021
Shame on everyone for these Frag Attack bugs. Some of the Wi-Fi bugs are in the official specs for how Wi-Fi is supposed to work. For that, shame on the Wi-Fi Alliance, a group that has previously shown itself not to be up to the job. The rest of the bugs fall on many assorted programmers for not programming to the specs. Not just the programmers working for one company, but for many companies. Why so much shame? It is very likely that every Wi-Fi device in the world has at least one of the 12 bugs. Quoting Vanhoef: "In experiments on more than 75 devices, all of them were vulnerable to one or more of the discovered attacks." Bug fixes are need from dozens, if not hundreds, of sources. We'll get some, over time, but these bugs are sure to last for decades. The design flaws are difficult to exploit according to Vanhoef: "... the biggest concern are the programming mistakes in Wi-Fi products since several of them are trivial to exploit." One defense is HTTPS. A VPN helps with some of the bugs, but not all. Quoting: "Using a VPN can prevent attacks where an adversary is trying to exfiltrate data. It will not prevent an adversary from bypassing your router's NAT/firewall to directly attack devices." Interestingly, Wi-Fi 6 (aka ax) is more vulnerable than Wi-Fi 5 (aka ac). Vanhoef has worked with the Wi-Fi Alliance for the last nine months to get these bugs fixed. To date, five companies have released patches. Vanhoef gets in a dig at the Wi-Fi Alliance when he says "...it's essential to regularly test Wi-Fi products for security vulnerabilities, which can for instance be done when certifying them." The Wi-Fi Alliance does this certification. We may be in good hands with Allstate, but that is not the case with the Wi-Fi Alliance. He also says the biggest risk is likely the ability to abuse these flaws to attack devices in someone's home network. He does not offer a defense, but I will - VLANs, or, at the least, Guest Wi-Fi networks. Or, a second router. The bug that scares me the most is the one that allows bad guys to bypass a router firewall and attack devices directly. He tested four consumer routers and found two were vulnerable, but he did not name names and did not say which of the 12 bugs they were vulnerable to. Check with your router vendor to see if they have anything to say about this. Likewise, fixes are needed for Access Points and operating systems.
How bad is this really? From the horse's mouth:
Does this mean every Wi-Fi device is trivial to attack?
"The design issues are, on their own, tedious to exploit in practice. Unfortunately, some of the implementation vulnerabilities are common and trivial to exploit. Additionally, by combining the design issues with certain implementation issues, the resulting attacks become more serious. This means the impact of our findings depends on the specific target. Your vendor can inform you what the precise impact is for specific devices. In other words, for some devices the impact is minor, while for others it's disastrous."

• Summary of Vulnerabilities by Mathy Vanhoef. One paragraph describing each of the 12 new bugs
• WiFi devices going back to 1997 vulnerable to new Frag Attacks by Catalin Cimpanu of The Record May 11, 2021
• FragAttacks: Presentation at USENIX Security '21 video by Mathy Vanhoef
• Wi-Fi Alliance security update – May 11, 2021 covering their your-know-whats
• Statement from the Industry Consortium for Advancement of Security on the Internet (ICASI) on Aggregation and Fragmentation Attacks against Wi-Fi has links to the fixes from five companies. Will this be updated in the future? They don't say.

Still more bugs in Cisco RV34X routers

Advisory: Cisco RV34X Series – Privilege Escalation in vpnTimer
by T. Shiomitsu of the IoT Inspector Research Lab   May 5, 2021
"A few weeks ago, we published an advisory on the Cisco RV series routers, where we outlined the root cause for authentication bypass and remote command execution issues. This week, Cisco has released an advisory for another bug we reported around the same time: A privilege escalation issue, which could be used in combination with the other two issues to run arbitrary code with root privileges on affected RV34X devices. ". The bug is CVE-2021-1520 - Privilege Escalation in vpnTimer. A look at old firmware shows that the bug has been present since at least the first firmware update package of the RV34X series back in February 2017). Vulnerable routers are the RV340, RV340W, RV345 and the RV345P. A fix is available.

• Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability by Cisco May 5, 2021

APRIL 2021

Bugs in Cisco RV34X series routers

Advisory: Cisco RV34X Series – Authentication Bypass and Remote Command Execution
by T. Shiomitsu of the IoT Inspector Research Lab   April 13, 2021
"In early 2021, we reported a few security issues to Cisco related to their RV34X series of routers, two of which have been recently patched. The issues in question were an authentication bypass and system command injection, both in the web management interface. These can be chained together to achieve unauthenticated command execution." Cisco took 4 months to release a fix (Jan 2, 2021 through April 7, 2021) and they admit that other devices are also affected. The bugs are CVE-2021-1472 - RV34X /upload Authorization Bypass Vulnerability and CVE-2021-1473 - RV34X OS Command injection in Cookie string.

• Cisco Small Business RV Series Routers Vulnerabilities from Cisco April 7, 2021. Quoting: "Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device."

Critical bug in Juniper Junos OS - fixes available

Critical Vulnerability Can Allow Attackers to Hijack or Disrupt Juniper Devices
by Eduard Kovacs of Security Week   April 16, 2021
A buffer size validation flaw may allow an unauthenticated remote attacker to send specially crafted packets to a vulnerable device, triggering a partial Denial of Service, or remote code execution. An attacker who successfully exploits the vulnerability can gain root access to the targeted system. The bug is in the overlayd daemon which runs as root by default and listens for UDP connections on port 4789. The underlying problem is improper buffer size validation, which can lead to a buffer overflow. The bug is CVE-2021-0254. Good news: Fixes are available and vulnerable devices are typically not exposed to the Internet. The bug was discovered by Nguyễn Hoàng Thạch with Singapore-based cybersecurity company STAR Labs.

• 2021-04 Security Bulletin: Junos OS: Remote code execution vulnerability in overlayd service by Juniper April 14, 2021
• Juniper Security Advisories. Maybe its just me, but there seem to be a very very large number of security flaws in their software.

MARCH 2021

Bug in D-Link DIR-3060 router

Advisory: D-Link DIR-3060 Authenticated RCE (CVE-2021-28144)
by IoT Inspector Research Lab   March 11, 2021
The D-Link DIR-3060 is affected by a post-authentication command injection vulnerability. Anybody with authenticated access to the router can run arbitrary system commands on the device as the system admin user, with root privileges. D-Link has released a patched firmware.

• DIR-3060 EXO AC3000 Smart Mesh Wi-Fi Router
• DIR-3060 :: H/W Ax :: F/W v1.11b04 :: Authenticated LAN-Side Command Injection from D-Link. No date, other than a bogus date in the future.

Bugs in Cisco RV132W and RV134W routers

CVE-2021-1287 Detail
by NIST   March 17, 2021
"A vulnerability in the web-based management interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly. The vulnerability exists because the web-based management interface does not properly validate user-supplied input.... A successful exploit could allow the attacker to execute arbitrary code as the root user .... " The attacker needs to be authenticated to the device before they can exploit the flaw. Fixes are available.

• Cisco Small Business RV132W and RV134W Routers Management Interface Remote Command Execution and Denial of Service Vulnerability by Cisco March 17, 2021.
• Cisco Plugs Security Hole in Small Business Routers by Lindsey O'Donnell for ThreatPost March 17, 2021

FEBRUARY 2021

Still more Cisco bugs

Cisco Warns of Critical Auth-Bypass Security Flaw
by Lindsey O'Donnell of Threatpost   February 25, 2021
"A critical vulnerability in Cisco Systems' intersite policy manager software could allow a remote attacker to bypass authentication. The vulnerability is one of three critical flaws fixed by Cisco on this week. It exists in Cisco’s ACI Multi-Site Orchestrator (ACI MSO) — this is Cisco’s management software for businesses ... The flaw stems from improper token validation on an API endpoint in Cisco’s ACI MSO. The vulnerability ranks 10 (out of 10) on the CVSS vulnerability-rating scale. The glitch is considered critical because an attacker - without any authentication - could remotely could exploit it..." Cisco also fixed a bug in their NX-OS network operating system for Nexus-series Ethernet switches. This flaw, which has a CVSS score of 9.8 out of 10, lets an unauthenticated, remote attacker create, delete or overwrite arbitrary files with root privileges on Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches.

• Cisco fixes maximum severity MSO auth bypass vulnerability by Sergiu Gatlan for Bleeping Computer. February 24, 2021

Paying more does not get you better software

Fortinet fixes critical vulnerabilities in SSL VPN and web firewall
by Ax Sharma of Bleeping Computer   February 7, 2021
There are assorted bugs in the FortiProxy SSL VPN and FortiWeb Web Application Firewall (WAF) products. The worst bug is in the FortiProxy SSL VPN, it can be triggered by a remote, unauthenticated attacker using a specially crafted POST request. A SQL Injection flaw (CVE-2020-29015) lets an attacker get the hash of the administrator account due to excessive DBMS user privileges. A Buffer Overflow flaw (CVE-2020-29016) allows for arbitrary code execution by a remote attacker without the password.

• Fortinet fixes vulnerabilities discovered by Positive Technologies by Fortinet February 4, 2021

JANUARY 2021

SonicWall hacked using a bug in their own software

SonicWall firewall maker hacked using zero-day in its VPN device
by Lawrence Abrams of Bleeping Computer   January 23, 2021
"SonicWall is a well-known manufacturer of hardware firewall devices, VPN gateways, and network security solutions whose products are commonly used in SMB/SME and large enterprise organizations." They released an advisory warning that hackers used a bug in their Secure Mobile Access (SMA) VPN device and their NetExtender VPN client to attack their internal systems. Until the bug is fixed they suggest enabling two-faction authentication and blocking web traffic from countries that do not need to access their devices. Then:
SonicWall SMA 100 zero-day exploit actively used in the wild by Lawrence Abrams February 1, 2021
SonicWall is still investigating the vulnerability and has not provided many details. It likely affects their SMA 100 series of remote access appliances. Another suggested mitigation is restricting the IP addresses than can access the SonicWall management interface. Then:
SonicWall fixes actively exploited SMA 100 zero-day vulnerability By Lawrence Abrams February 3, 2021
They released a patch for the bug in the SMA 100 series of appliances running firmware version 10.x. Specifically: the SMA 200, SMA 210, SMA 400, SMA 410 and the virtual SMA 500v appliance. They have still not provided any details on the vulnerability. Tweets from the NCC Group indicate that it allows remote access to the management interface without authorization.

• Urgent Patch Available For SMA 100 Series 10.X Firmware Zero-Day Vulnerability From SonicWall Jan. 22 through Feb. 4, 2021. Good thing: this fix is available for everybody, regardless of the status of their support/service contract.

And ... still MORE Cisco bugs

Cisco reveals critical bug in small biz VPN routers when half the world is stuck working at home
by Simon Sharwood of The Register   February 5, 2021
This is as bad as bad gets. The worst bugs "can be exploited by an unauthenticated, remote attacker to execute arbitrary code as the root user. All the attacker needs to do is send a maliciously crafted HTTP request to the web-based management interface." Routers vulnerable to this are: RV160, RV160W, RV260, RV260P, and RV260W. Other bugs allow a remote bad guy, again without a password, to "conduct directory traversal attacks and overwrite certain files that should be restricted ...." Other Cisco routers, the RV016, RV042, RV042G, RV082, RV320, and RV325 have still other bugs. All the bugs seem to be due to lazy Cisco employees who can't be bothered to validate input. Four buggy routers, the RV016, RV042, RV042G, and RV082 are not getting updates because they are too old. If the bugs don't turn you away from Cisco, consider the tech support experience - they put most of the burden on you. These quotes are from the bug Advisories below.
You want the patches? "... customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner." You want to learn about available updates? Cisco won't tell you. "When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure..." Will the available update work on your hardware? You figure it out. "In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release." I don't even know what the last part of that quote means. The big point is that you pump your own gas when you are a Cisco customer. I would not use their hardware for a paper weight.

• Cisco warns of critical remote code execution flaws in these small business VPN routers by Liam Tung of ZDNet February 5, 2021
• Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities From Cisco, about the Critical severity bugs. Patches are available. Feb 3, 2021.
• Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write Vulnerabilities From Cisco about the High severity bugs. Feb 3, 2021. Patches are available.

More Cisco bugs

High-Severity Cisco Flaw Found in CMX Software For Retailers
by Lindsey O'Donnell of ThreatPost   January 13, 2021
At this point, I would not trust or even want to touch any hardware or software from Cisco. Their software has too many bugs and this case shows their refusal to fix some bugs. Cisco addressed 67 high-severity bugs. That is far too many to have in software that is reasonably mature. Far too many. Sixty of the bugs exist in in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W and RV215W routers. Quoting: "Of note, Cisco said it would not release software updates for the Cisco Small Business RV110W, RV130, RV130W and RV215W routers, as they have reached end of life."

2020

DECEMBER 2020

Bugs bugs bugs bugs bugs bugs

Vulnerability Summary for the Week of December 28, 2020 Bulletin (SB21-004)
by the CISA branch of the US Government   January 4, 2021
A summary of new vulnerabilities that have been recorded in the past week. Again, just one week. Below is a summary of the CISA summary for assorted devices from networking companies. They may not all be routers and the severity of the bugs vary widely.
---------
Tenda AC1200 (Model AC6) the default settings for the router speed test contain links to download malware CVE-2020-28094
Tenda AC1200 (Model AC6) a large HTTP POST request sent to the change password API will trigger the router to crash and enter an infinite boot loop. CVE-2020-28095
Tenda N300 F3 devices allow remote attackers to obtain sensitive information via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg CVE-2020-35391
Tenda AC1200 (Model AC6) userids: admin, support, user, and nobody have a password of 1234. CVE-2020-28093
---------
Belkin LINKSYS RE6500 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters CVE-2020-35713
Belkin LINKSYS RE6500 allow remote attackers to cause a persistent denial of service (segmentation fault) CVE-2020-35716
Belkin LINKSYS RE6500 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename CVE-2020-35715 and CVE-2020-35714
---------
TP-Link: a password-disclosure issue in the web interface of certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. CVE-2020-35575
---------
Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. CVE-2020-29299
------------
DrayTek Vigor2960 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi. CVE-2020-19664
-------------
Certain NETGEAR devices are affected by disclosure of sensitive information. CVE-2020-35802
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. CVE-2020-35787
Certain NETGEAR devices are affected by command injection by an authenticated user. CVE-2020-35793
NETGEAR DGN2200v1 devices mishandle HTTPd authentication CVE-2020-35785
NETGEAR GS716Tv3 and GS724Tv4 are affected by CSRF. CVE-2020-35778
NETGEAR JGS516PE , JGS524PE, JGS524Ev2 and GS116Ev2 are affected by lack of access control at the function level. CVE-2020-35784
NETGEAR JGS516PE, JGS524Ev2, JGS524PE and GS116Ev2 are affected by incorrect configuration of security settings. CVE-2020-35801
NETGEAR NMS300 devices are affected by command injection by an authenticated user. CVE-2020-35789
NETGEAR NMS300 devices are affected by denial of service. CVE-2020-35780 and CVE-2020-35781
NETGEAR R7500v2, R8900, R9000 and R7800 are affected by command injection by an authenticated user. CVE-2020-35792 and CVE-2020-35791
NETGEAR RBS40V, RBK752, RBR750, RBS750, RBK852, RBR850 and RBS850 are affected by command injection by an authenticated user. CVE-2020-35794
NETGEAR WAC104 devices are affected by a buffer overflow by an authenticated user. CVE-2020-35788
NETGEAR D6200, D7000, JNR1010v2, JR6150, JWNR2010v5, R6020, R6050, R6080, R6120, R6220, R6260, WNR1000v4, WNR2020 and WNR2050 are affected by stored XSS. CVE-2020-35840 and CVE-2020-35842
NETGEAR R7800 is affected by a buffer overflow by an authenticated user. CVE-2020-35786
NETGEAR D7800, R7500v2, R7800, R8900, R9000, RAX120, RBK50, RBR50, RBS50, XR500 and XR700 are affected by stored XSS. CVE-2020-35824 and CVE-2020-35830 and CVE-2020-35835
NETGEAR D7800, R7800, R8900, R9000 and XR700 are affected by disclosure of sensitive information. CVE-2020-35804 and CVE-2020-35838 and CVE-2020-35837
NETGEAR R6400v2, R6700v3, R6900P, R7000, R7000P, R7800, R7850, R7900, R7960P, R8000, R7900P, R8000P, RAX15, RAX20, RAX200, RAX45, RAX50, RAX75, RAX80, RBK752, RBR750, RBS750, RBK852, RBR850, RBS850, RBK842, RBR840, RBS840, RS400 and XR300 are affected by command injection by an unauthenticated attacker. CVE-2020-35798
---------
Just ... one ... week.

• CISA weely vulnerability summaries

Critical bug in D-Link DSR VPN routers

D-Link VPN routers get patch for remote command injection bugs
by Ionut Ilascu of Bleeping Computer   December 8, 2020
No one makes money saying that newly discovered bugs are not that big a deal. So, this trio of D-Link bugs may or may not be a big deal, despite the fact that everyone says the sky is falling. To be clear, the most critical of the three bugs is indeed the worst possible type of flaw - anyone on the Internet can totally hack these routers. What is not said, however, is whether the web interface to these routers is exposed to the Internet by default. If not, this is much less of an issue. I suspect the web interface is not available remotely because if it was, the company that found these bugs would say so. Either way, D-Link should say something about this in their response, but, they do not. They don't care about security. Further proof about how little D-Link cares about security is the timeline. Three bugs were reported to them on August 11, 2020. Their first response was early December 2020. They fixed two of the bugs and consider the third not a real problem. The most critical bug can also be exploited on the LAN but VLANs can be used to limit access to the web based Admin interface. At least on good routers they can. I don't know if these routers support VLANs. The bugs affect the DSR-150, DSR-250, DSR-500 and DSR-1000.

• Work From Home Use of Popular VPN Routers Increases Immediacy of Critical Patch from Digital Defense the company that found the bugs. December 8, 2020. Quoting: "The vulnerable component of these devices is accessible without authentication. From both WAN and LAN interfaces, this vulnerability could be exploited over the Internet. Consequently, a remote, unauthenticated attacker with access to the router’s web interface could execute arbitrary commands as root, effectively gaining complete control of the router."
• The D-Link DSR series of VPN routers
• DSR Family Products :: F/W v3.17 & Older :: CVE-2020-25757 / CVE-2020-25758 / CVE-2020-25759 : Unauthenticated & Authenticated Command Injection Vulnerabilities This is the D-Link advisory about the three bugs. Note that even after 4 months, the newly released firmware is considered Beta.

NOVEMBER 2020

Avoid routers from Jetstream and Wavlink

Walmart-exclusive router and others sold on Amazon and eBay contain hidden backdoors to control devices
by Bernard Meyer of CyberNews.com   November 23, 2020
This expands on a problem first noticed in April 2020. Quoting: "In a collaboration between CyberNews Sr. Information Security Researcher Mantas Sasnauskas and researchers James Clee and Roni Carta, suspicious backdoors have been discovered in a Chinese-made Jetstream router, sold exclusively at Walmart as their new line of 'affordable' wifi routers. This backdoor would allow an attacker the ability to remotely control not only the routers, but also any devices connected to that network ... the cybersecurity research team also discovered that low-cost Wavlink routers, normally sold on Amazon or eBay, have similar backdoors. The Wavlink routers also contain a script that lists nearby wifi and has the capability to connect to those networks ... While Jetstream has an exclusive deal with Walmart, and is sold under other brand names like Ematic, there is very little information available about which Chinese company actually produces these products ... While Clee's original research (and follow-up) analyzed one Wavlink router, our new analysis shows that multiple Wavlink and Jetstream devices have now been shown to be affected. In fact, all of the devices that the team analyzed were found to contain backdoors.

Routers from Asus and TP-Link hacked at a hacking contest

Routers, NAS Devices, TVs Hacked at Pwn2Own Tokyo 2020
by Eduard Kovacs of Security Week   November 9, 2020
Update: Dec 17, 2020: I am tracking the acknowledgment and/or fix for the Asus router on the News page. So far, nothing.
Update Nov 13, 2020: It appears that one of these articles was wrong. The Netgear router was not hacked. Also, the TP-Link router is not sold in the US.
The three routers that have been reportedly been hacked at the contest are the ASUS RT-AX86U, the TP-Link TL-WDR7660 and the NETGEAR Nighthawk R7800. Two bugs were found in the Netgear router. The bugs will be disclosed to the hardware manufacturers and hopefully fixes will be released. What no one will say is whether the same bugs exist in other routers from these companies.

• Windows 10, iOS, Chrome, Firefox and Others Hacked at Tianfu Cup Competition by Ravie Lakshmanan of Hacker News November 8, 2020

OCTOBER 2020

The second critical flaw for SonicWall this year

800,000 SonicWall VPNs vulnerable to new remote code execution bug
by Catalin Cimpanu of ZDNet   October 15, 2020
SonicWall Network Security Appliances are used as firewalls and SSL VPN portals to control access internal and private networks. The Tripwire VERT security team discovered a bug that exists in almost 800,000 internet-accessible SonicWall VPN appliances. The bug is considered critical and is expected to come under active exploitation once proof-of-concept code is made publicly available. The underlying problem is a stack-based buffer overflow. To exploit the bug, bad guys do not need to have valid credentials. Oh, and the bug is trivial to exploit, even for unskilled attackers. This is SonicWall's second major bug this year. Patches are available.

• SonicWall VPN Portal Critical Flaw (CVE-2020-5135) by Craig Young of TripWire October 14, 2020. This is the original research. The flaw can be triggered by an unauthenticated HTTP request involving a custom protocol handler. The vulnerability exists within the HTTP/HTTPS service used for product management as well as SSL VPN remote access.

JULY 2020

Asus router bug and insight into Asus itself

ASUS Router Vulnerable to Fake Updates and XSS
by Martin Rakhmanov of Trustwave   July 23, 2020
Rakhmanov found two bugs in the ASUS RT-AC1900P router and the company has fixed them. One bug (CVE-2020-15498) was that the firmware update process accepted software with forget server certificates. This would have let spies and hackers install their own firmware on their router. An attacker would have to be adjacent network-wise to the router to perform this man in the middle attack, but it could result in a full compromise of the router. The other bug (CVE-2020-15499) was an XSS in a dialog window of the admin interface. There are two things here that are very important, much moreso than the bugs themselves. Neither ASUS nor Rakhmanov said anything about other ASUS routers. It is very likely they too are vulnerable, but it is none of our business. Then too, there is the way Asus handled this. For one thing they never issued a security advisory. And, as we see below in the Revision History, they could not be bothered to tell Rakhmanov when they fixed the bug. And, when he asked they were not sure if they fixed one or both bugs.

• Revision History:
  12/17/2019 - Vulnerability disclosed to vendor
  03/10/2020 - Patch released by vendor without notification
  04/06/2020 - Researcher discovered a new ASUS patch
  05/14/2020 - Vendor could not confirm whether the patch fixes both issues
  06/08/2020 - Researcher confirms that patch fixes both issues

Multiple D-Link router bugs

5 severe D-Link router vulnerabilities disclosed, patch now
By Ax Sharma of Bleeping computer   July 24, 2020
It is not clear from this story which routers are buggy. The research the story is based on is for a router that is End-of-Life (no more bug fixes, it's too darn old to bother with). The bugs are in the web interface to the router, as they often are. Best practices for router security is always to limit LAN side access to the router's admin interface, and, of course, to disable remote administration. I found one bug quite noteworthy. It lets a bad guy bypass the router password by adding a couple parameters to the HTTP request to the router. The same flaw was reported in 2010 and again in 2011. That tells you all you need to know about D-Link.

• Multiple Vulnerabilities discovered in the D-link Firmware DIR-816L by Loginsoft. July 23, 2020. This router is EoL. Vendor Disclosure was Feb. 9, 2019.

Way too many bugs in Cisco software

Cisco releases security fixes for critical VPN, router vulnerabilities
by Charlie Osborne for ZDNet   July 17, 2020
For the most part, I leave out Cisco bugs from this page because there are just too many of them. The number of critical bugs in Cisco software over the years has been far too high. I would not use their products. Cisco just released fixes for 34 bugs, five of which are the most critical in that they allow bad guys to get total control of vulnerable devices. One issue is the Telnet service in the Small Business RV110W Wireless-N VPN Firewall router. It has a default, static password that, if obtained by attackers, can lead to the full remote hijacking of a device. This is a mistake that can not be forgiven and not the first time Cisco has had hard coded passwords. A flaw in the management interface of the Cisco Small Business RV110W, RV130, RV130W, and RV215W routers can be exploited to execute arbitrary code as the root user. This is a very common flaw, improper validation of input. Translation: lazy programmers. Same thing with the web interface of the Cisco RV110W VPN Firewall and RV215W VPN router.

• Cisco Security Advisories from Cisco. Lots of bugs documented in the middle of July.

Do not buy a router from Tenda

Tenda AC15 AC1900 Vulnerabilities Discovered and Exploited
by Sanjana Sarda of Independent Security Evaluators   July 10, 2020
Their research uncovered five bugs including two methods attackers can use to gain persistent unauthenticated root access to the router. They also found 7 open LAN side ports. Much of this article is focused on the specifics on the bugs and it leaves out the implications. Are the bugs exploitable LAN side or WAN side or both? Does a user have to be logged in to exploit the bug or not? Despite this, the article is very useful at the end. ISE first contacted Tenda in January 2020. Here, six months later, no response from Tenda at all. And, as always with router bugs, it is likely that similar flaws exist in other firmware versions and other Tenda routers.

• Researchers Say This Router Is Open to Outside Attack by Hackers by Kevin Truong of Vice July 13, 2020. The article adds some context to the story but does not clarify the nature of the bugs.

JUNE 2020

79 Netgear devices are buggy and the company did nothing

SOHO Device Exploitation
by Adam of Grimm   June 15, 2020
Quoting: "This is just one more example of how SOHO device security has fallen behind as compared to other modern software ... As such, it’s trivial to overflow the stack buffer." The author found a pre-authentication stack overflow vulnerability in the Netgear R7000 router running firmware version 1.0.9.88. The vulnerability, which allows for remote code execution, has been present in the R7000 since it was released in 2013. But that is only the beginning. Adam was able to identify 79 different Netgear devices and 758 Netgear firmware images that included the buggy code. The oldest buggy firmware dated back to 2007. The vulnerability was reported to Netgear on May 7, 2020 and they seemed to have ignored it. Using assorted scripts, Adam created an exploit for each of the 758 buggy firmware images. Then, he tested his exploit on 28 of the vulnerable devices to ensure that it worked as expected. Among the confirmed buggy routers are the Netgear R6250, R6300v2, R6400, R7000, R8000, R8300 and the R8500. Criticizing Netgear he said "In addition to lacking stack cookies, the web server is also not compiled as a Position-independent Executable (PIE), and thus cannot take full advantage of ASLR. As such, it’s trivial to find a ROP gadget within the httpd binary ... that will call system with a command taken from the overflown stack."

• Dozens of Netgear routers can easily be hacked - what to do right now [updated] by Paul Wagenseil. Discusses two defenses, the obvious one being turning off remote administration. Netgear just released hotfixes for two of the routers. June 19, 2020
• Unpatched vulnerability identified in 79 Netgear router models by Catalin Cimpanu for ZDNet. The article has the full list of 79 vulnerable models. June 18, 2020
• 79 Netgear router models risk full takeover due to unpatched bug by Lawrence Abrams of Bleeping Computer June 18, 2020
• The proof of concept exploit at Github. It is a Python script that starts the telnet daemon as root listening on TCP port 8888 and not requiring a password to login. The exploit will automatically determine the device model/version and then exploit it to start telnet. Part of the NotQuite0DayFriday repository from Grimm.
• NETGEAR R6700 httpd Firmware Upload Stack-based Buffer Overflow Remote Code Execution Vulnerability from Zero Day Initiative. June 15, 2020. Looks to be a similar bug to the above. Maybe the same? Can't tell as this has no technical details. This bug was discovered by d4rkn3ss from VNPT ISC. The interesting thing here, to me, is how Netgear ignored the bug report for six months. Here is the timeline:
  01/08/20 - ZDI reported the vulnerability to the vendor
  04/30/20 - ZDI contacted the vendor requesting a status update
  05/01/20 - The vendor requested an extension until the end of June
  05/05/20 - ZDI agreed on extension until June 15th
  05/28/20 - ZDI requested a status update
  05/29/20 - The vendor requested an extension until the end of June
  05/29/20 - ZDI declined the request and notified the vendor the case would be published as 0-day on June 15, 2020
• Security Advisory for Multiple Vulnerabilities on Some Routers, Mobile Routers, Modems, Gateways, and Extenders from Netgear June 18, 2020. First sentence: "This security advisory addresses the following PSV IDs ..." If you don't know what a PSV ID is (I do not), then Netgear may not be the right router vendor for you.
• Living on a prayer? Netgear not quite halfway there with patches for 28 out of 79 vulnerable router models The Register June 30, 2020.

Bugs in a very old D-Link router

D-Link leaves severe security bugs in home router unpatched
by Ionut Ilascu of Bleeping Computer   June 12, 2020
The D-Link DIR-865L router was released in 2012 and is no longer supported for U.S. consumers. However, on the website for European countries, the status is "End of Sale" which means that it can no longer be purchased but it is still supported by the vendor. Researchers at Palo Alto Networks' Unit 42 found and reported six security vulnerabilities in the DIR-865L in late February 2020. Now, over three months later, D-Link released beta firmware that fixes three of the six flaws. Two bigger issues: 1) What about other models? Unit 42 warned that newer routers may be vulnerable to the same flaws because they share a common code base. A good router vendor will check for the same flaw in all their products. A bad router vendor will not. The response from D-Link said nothing about any other models. 2) Who cares about such an old router? Why is Unit 42 even looking at ancient consumer devices? In the US, the DIR-865L went out of support in Feb. 2016.

• 6 New Vulnerabilities Found on D-Link Home Routers by Gregory Basior of Unit 42. June 12, 2020
• DIR-865L :: Rev. Ax :: End of Service Product :: Multiple Vulnerabilities the official response from D-Link. No date.

APRIL 2020

Wavlink does not respond to security flaws - another brand to avoid

Multiple Vulnerabilities in Wavlink Router leads to Unauthenticated Remote Code Execution
by James Clee   April 18, 2020
Clee started a new hobby - buying cheap Chinese technology to see what he could find out about security. He startee with the Wavlink WL-WN530HG4 which sells for $30. An interesting read that resulted in CVE-2020-10971 and CVE-2020-10972. He found back doors and miserable password verifications. Quoting: "... so an attacker with the right background information about the device could achieve RCE fairly easily." Worse, is that he attempted multiple times to contact Wavlink using several different support contacts and they ignored him. This is not a company you want to deal with.
A few days later he wrote about the Wavlink WL-WN579G3 and WL-WN579A3 Wi-Fi Extenders. They were just as bad as the router. He found that lots of web pages are externally accessible without authentication and they contain sensitive data. He could get the username and password without authenticating to the devices. Once again, Wavlink did not respond to any of his attempts at communication.

• More Information Disclosure in Wavlink Devices: CVE-2020-10973, CVE-2020-10974, and CVE-2020-12266 by James Clee April 23, 2020
• Update: November 2020. An article on this page (above) from November 2020, expands on this. It is not just one Wavlink router with a backdoor. New analysis by Clee and others found that multiple Wavlink and Jetstream devices are affected. In fact, all of the devices that the team analyzed were found to contain backdoors.

Sophos quickly issues patch for their firewalls

Hackers are exploiting a Sophos firewall zero-day
by Catalin Cimpanu for ZDNet   April 26, 2020
Bad guys were found to be attacking a previously unknown SQL injection vulnerability in the Sophos XG enterprise firewall. Sophos learned about the problem on April 22nd when a customer reported something strange. They published an emergency security update on April 25th. The firewalls can self-update, though I doubt every user has that enabled. No surprise to learn that vulnerable firewalls had either their administration or User Portal control panel exposed to the Internet. The bug let bad guys steal files from the XG firewall, and those files could include usernames and hashed passwords for the firewall administrator, for the firewall portal admins and for user accounts used for remote access to the device. Bad guys could also learn the firewall's license and serial number, and see some user emails. Sophos researchers named the malware Asnarok. From what I have seen, the Sophos response was great. You could not ask for more. Not only did they fix the bug quickly, they also documented the heck out of the issue.

• Fixing SQL injection vulnerability and malicious code execution in XG Firewall/SFOS from Sophos April 27, 2020. An extensive explanation of the problem.
• Asnarok Trojan targets firewalls from Sophos April 26, 2020. More detailed explanations.

MARCH 2020

Multiple issues with OpenWRT

Uncovering OpenWRT remote code execution (CVE-2020-7982)
by Guido Vranken of ForAllSecure   March 24, 2020
The OpenWRT package manager, opkg, does not check the SHA256 hash of anything it downloads. This is compounded by it downloading updates over HTTP rather than HTTPS. In addition, the opkg unpacker is buggy; malformed data leads to a variety of memory violations. opkg on OpenWrt runs as root with write access to the entire filesystem, so arbitrary code could be injected by means of forged .ipk packages with malicious payloads. Also vulnerable is the LEDE fork of OpenWRT. One of the bugs was introduced in February 2017. Fixes are available.

• Security Advisory 2020-01-31-1 - Opkg susceptible to MITM (CVE-2020-7982) from OpenWRT.
• Security Now! podcast episdoe 760 March 31, 2020

Two Zero Day bugs in DrayTek routers (Updated)

A mysterious hacker group is eavesdropping on corporate email and FTP traffic
by Catalin Cimpanu of ZDNet   March 28, 2020
According to Netlab, the network security division of Chinese security firm Qihoo 360, bad guys have been hacking into DrayTek routers to eavesdrop on FTP and email traffic. They first observed this in early December 2019. There are two different zero-day flaws in three DrayTek Vigor devices, the 2960, 3900 and 300B. The bugs could allow for arbitrary code execution on a vulnerable system. This could allow an attacker to eavesdrop on network traffic, operate SSH and Web based backdoors, and create system accounts. One flaw is in the login mechanism and it allows attackers to hide malicious code inside the router's username field. This malicious code can grant the hackers control over the router. Next, the attackers started recording traffic coming to port 21 (FTP), 25 (email), 110 (email) and 143 (email). These are four very old protocols and they still use plain text. It is assumed the attackers were looking for FTP and email passwords. The second flaw is in the "rtick" process and attackers used it to create backdoor accounts on the hacked routers. Qihoo says that around 100,000 vulnerable DrayTek devices are online. DrayTek issued updated firmware six days after they learned of the problem. And, DrayTek impressed me with this " The issue only affects the Vigor3900 / 2960 / 300B and is not known to affect any other DrayTek products". This is rare, vendors usually fix only the devices with the reported problem.

• Two zero days are Targeting DrayTek Broadband CPE Devices by Yanlong Ma, Genshen Ye, Hongda Liu of Netlab 360. March 27, 2020
• Vigor3900 / Vigor2960 / Vigor300B Router Web Management Page Vulnerability (CVE-2020-8515) from DrayTek Feb. 10, 2020.
• Multiple Vulnerabilities in DrayTek Products Could Allow for Arbitrary Code Execution by the Center for Internet Security April 1, 2020
• Grandstream and DrayTek Devices Exploited to Power New Hoaxcalls DDoS Botnet by Ken Hsu, Haozhe Zhang, Zhibin Zhang and Ruchna Nigam of Unit 42 of Palo Alto Networks. April 3, 2020.

Multiple flaws in multiple Netgear routers

Thousands of Netgear routers are at risk of getting hacked: What to do
by Paul Wagenseil of Toms Guide   March 5, 2020
Nearly 50 Netgear devices need firmware patches ASAP. The devices are seven modem-router gateways, 40-odd routers (including some Nighthawk and Orbi models) and one range extender. The worst of the flaws lets attackers remotely install malware on one router. A "pre-authentication command injection security vulnerability" on five routers could also lead to total network takeover. For a number of the flaws Netgear has not provided specific details. Does your Netgear router need an update? Turns out, this is a hard question to answer. Netgear does a terrible job of communicating to its customers what each router's model number is. They hardly ever use the actual model number in their consumer marketing and packaging. For example, the AC4000 Nighthawk X6S Tri-Band WiFi Router is the R8000P. To find the model number, turn the device over and look at the sticker on the bottom. The update procedure differs among the various routers. The article has a full list of the buggy router model numbers.

• Security Advisory for Unauthenticated Remote Code Execution on R7800 from Netgear March 3, 2020. This has no information about the bug at all. Nuttin.
• Security Advisory for Pre-Authentication Command Injection on Some Routers from Netgear March 3, 2020. This too has no information at all about the flaw.
• Critical Netgear Bug Impacts Flagship Nighthawk Router by Tom Spring March 4, 2020. Adds some perspective: "Netgear has a long history of patching command injection flaws dating back to 2013..."

JANUARY 2020

Millions of Internet boxes are vulnerable

Cable Haunt
by Lyrebirds ApS   January 11, 2020
Bad news: untold millions of devices are vulnerable. Good news: it is not easy to exploit the bug. Bad news: despite all the headlines, it is not only modems that are vulnerable, so too are gateways (combination modem/router). Bad news: In the US, this will never be fixed. ISPs are virtual monopolies and thus have no reason to do a good job. Fixing this takes time, effort and money and few very customers will ever learn about it. I tried to get a response from Spectrum, it was a waste of time. The company that found the flaw offered a tester script for Linux that seems useless. They also offered some JavaScript that can copied and pasted into a browser console to test if your Internet box is vulnerable. With their JavaScript, I confirmed that the Netgear CM600 modem is vulnerable. They leave out that you need to copy/paste their Javascript as a whole, not each line individually. And, you may need to change the port number, which is why I suggest using nmap below. Netgear only offers free tech support for the first 90 days, so I can not ask them about this. Not that it matters, modem firmware can only be updated by an ISP, at least in the US.
What to do?
I suppose you could try and learn the firmware version that your modem or gateway is running and then try to find out if it has been patched for the Cable Haunt flaw. In the US, this is almost definitely a waste of time.
First, see if your Internet box uses Broadcom. If not, you are safe. The Toms Guide article below has links to pages that show this for Arris and Netgear devices. For other companies see approvedmodems.com. If that fails, perhaps look for the technical specs of your modem or gateway. Maybe try to contact the hardware manufacturer. If Broadcom ...
If you have a router/modem combination box, run nmap on the LAN side IP address looking at all 65,535 TCP ports. If you have a router and a modem as stand-alone devices, run the same nmap against 192.168.100.1. After the nmap scan, try to use HTTP and HTTPS to access every open port. The buggy Spectrum Analyzer looks like this on a Netgear modem. Found a Spectrum Analyzer? If so, nag either your ISP or the hardware vendor for fixed software. Lotsa luck (probably won't happen). Better yet, block access to the buggy device. If its a combination modem/router, there should be some sort of LAN side restrictions about which devices can logon to the box. For more, see the Security Checklist page here, the section on Local Administration. If you have a router and a modem as separate devices, you need a nerd to configure a defense. One option is something called a static route - some routers let you configure this, some do not. If your router supports firewall rules (rare), see my blog below about creating an outbound firewall rule to block modem access. As a rule consumer routers, such as AmpliFi from Ubiquiti or Google WiFi do not offer outbound firewall rules.

• Cable Haunt vulnerability tests by Lyrebirds Jan. 2020
• Hundreds of millions of Broadcom-based cable modems at risk of remote hijacking, eggheads fear by Shaun Nichols of The Register Jan. 10, 2020. Broadcom released fixed software to their customers (ISPs and hardware vendors) in May 2019. When asked if the updated software was widely deployed, Broadcom had no comment.
• Hundreds of millions of cable modems could be hacked due to 'Cable Haunt' flaw by Paul Wagenseil of Toms Guide Jan. 13, 2020. The article has links to web pages that show where Internet boxes are using Broadcom or not. See Arris and Netgear.
• Using a router to block a modem by me in 2015. If your router provides outbound firewall rules, it can block LAN side access to a modem which offers perfect protection.

2019

DECEMBER 2019

Multiple bugs in Ruckus Access Points

A ton of Ruckus Wireless routers are vulnerable to hackers
by Zack Whittaker of TechCrunch   December 28, 2019
Despite the headline, the buggy devices are Access Points not routers. Security researcher Gal Zror discovered 10 bugs in Ruckus devices. Three are biggies. They are in the web interface of the Unleashed line of APs. The flaws let a bad guy take complete control of a vulnerable router remotely and without needing a password. As bad as bad gets. Patches have been issued but the routers do not self-update. Ruckus Cloud access points are not buggy. Neither are their SmartZone-enabled devices. This was made public at a presentation at the 36th Chaos Communication Congress called Lecture: Don't Ruck Us Too Hard - Owning Ruckus AP Devices. This surprised me. For one, its the first mention of Ruckus in my list of bugs. Second, Ruckus is a high end company. Then again, Cisco is also high end and their software has a terrible track record when it comes to bugs and flaws and vulnerabilities.

• Video of the presentation Dec 28, 2019

More buggy D-Link routers

D-Link DIR-859 —Unauthenticated RCE (CVE-2019–17621)
by Miguel Méndez Z.   Decembe 24, 2019
Back in Oct. 2019, we learned of a Remote Code Execution bug in a single D-Link router, the DIR-859 (CVE-2019-17621). The bug could be exploited by anyone on the LAN to take full control of the router. Of course, many routers from the same company share the same firmware (operating system) so it was not a surprise when, in Nov. 2019, we learned that many more D-Link routers share the same bug. Some of the buggy routers are too old and will not be updated. Some have already had fixes released. Still more, are slated to have fixes released soon. These are the buggy models: DIR-818Lx DIR-822, DIR-823, DIR-859, DIR-865L, DIR-868L, DIR-869, DIR-880L, DIR-890, DIR-885, DIR-895. In some cases, the router firmware must be updated twice. Ugh. The vulnerability is in the code used to manage UPnP requests.

• DIR-818Lx Rev Bx / DIR-822 Rev Bx & Cx /DIR-823 Rev Ax / DIR-859 Rev Ax / DIR-865L Rev Ax / DIR-868L Rev Ax & Bx / DIR-869 Rev Ax / DIR-880L Rev Ax / DIR-885L Rev Ax / DIR-890L Rev Ax / DIR-895L Rev Ax :: CVE-2019-17621 :: Unauthenticated remote command execution & Information Disclosure LAN-side security vulnerability from D-Link Dec 26, 2019
• Remote Command Execution Vulnerability Affects Many D-Link Routers by Eduard Kovacs Jan 2, 2020

Four buggy TP-Link routers

TP-Link Archer Router Vulnerability Voids Admin Password, Can Allow Remote Takeover
by Grzegorz Wypych and Limor Kessem of IBM X-Force Red   December 16, 2019
There are critical bugs in the TP-Link Archer C5 v4, Archer MR200v4, Archer MR400v3 and the MR6400v4. Are other TP-Link routers safe? Don't know. No one said anything about other routers having been tested. The bug lets a bad guy take full admin control of the router. First, the bad guy has to trick the router as to the source of a login request. This is not hard. Then, the bad guy simply has to provide a password that is the wrong length. If the password is too short, it locks out access to the router. If the password is too long, it voids the current password letting the bad guy login without a password. TP-Link never fails to impress. Firmware updates are available. However, as the article below by Paul Wagenseil details, the firmware update process is miserable. The Archer MR200, MR400 and MR6400 are LTE-based routers sold in the European Union. The Archer C5 AC1200 is a home Wi-Fi router, sold in many countries.

• TP-Link routers can be hacked: What to do now by Paul Wagenseil of Toms Guide. Dec 17, 2019.
• TP-Link Router Bug Lets Attackers Login Without Passwords by Sergiu Gatlan of Bleeping Computer Dec16, 2019

NOVEMBER 2019

More buggy D-Link routers that will not be fixed

D-Link Adds More Buggy Router Models to 'Won’t Fix' List
by Tom Spring of ThreatPost   November 19, 2019
A new bug in D-Link routers will not be fixed because the routers are too old to bother with (they are End-of-Life or EoL). The bug allows a bad guy, who does not know any passwords, to access the web configuration interface of the router. The buggy devices are: DIR-866, DIR-655, DHP-1565, DIR-652, DAP-1533, DGL-5500, DIR-130, DIR-330, DIR-615, DIR-825, DIR-835, DIR-855L, and DIR-862. D-Link suggests disabling remote administration, resetting the affected routers and using a complicated router password. It is not clear if this bug is similar to the bug (CVE-2019-16920) that FortiGuard Labs reported last month. That bug impacted 10 of the same routers. Spring puts this bug in perspective, noting a long history of bugs in D-Link routers. A September 2019 bug can leak passwords. A May 2019 bug allowed DNS hijacking. In 2017, we learned that the D-Link DIR-130 was one of 25 routers that could be exploited by the CIA. Also in 2017, the 850L and AC1200 had multiple vulnerabilities that could allow a hacker to gain remote access and control of device.

• Unauthenticated RCE for EoL routers from D-Link Nov. 19, 2019

Zero Day flaw in the D-Link DIR-878 router. Others too?

Tianfu Cup Round-Up: Safari, Chrome, D-Link Routers and Office 365 Successfully Hacked
by Elizabeth Montalbano of ThreatPost   November 18, 2019
Hackers, at the annual Tianfu Cup gathering over the weekend, successfully compromised the D-Link DIR-878 router using a zero-day vulnerability. Note the plural use of the word hackers. The router was hacked by seven, yes, seven, different groups. It has been a few days and, so far, no response from D-Link on their security bulletin page. Will they acknowledge the flaw? Will they fix it? Time will tell. The bigger picture, however, involves other D-Link router. It is likely that other similar routers share the same buggy software. And, some recent history: in March 2019 the German Federal Office for Information and Security (BSI) issued a warning about bugs in the DIR-878 and the DIR-825. The bugs are easily exploited and let attackers bypass the logon processes and execute malicious code.

• Three teams hacked the router on the first day. tweet by @TianfuCup on Nov. 16, 2019 says "Three teams ... controlled #DLink DIR-878 successfully"
• Four teams hacked the DIR-878 on the second day. tweet by @TianfuCup on Nov. 16, 2019 says: "Today, 4 more teams also succeeded in hacking the D-Link DIR-878 ... "
• D-Link investigates router vulnerability after German security agency warning by CET news. March 2019

OCTOBER 2019

Ten D-Link routers that should be thrown away

Multiple D-Link routers vulnerable to remote command execution
by US Cert   October 23, 2019
These 10 D-Link routers are buggy, will not be fixed and should be thrown away: DIR-655, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835 and the DIR-825. A remote, unauthenticated attacker may be able to execute commands with root privileges on a buggy router. This can happen as the result of viewing a specially-crafted web page. The bug was publicly disclosed by Fortinet's FortiGuard Labs, same as below. This appears to be the same bugs as below, just that is has been found in six more routers.

• Proof of Concept. On a vulnerable router, this will disconnect the internet for a minute.

D-Link won't fix bugs in four of its routers

D-Link Won't Fix Serious Security Flaw on Four Wi-Fi Routers
by Paul Wagenseil of Tom's Guide   October 8, 2019
Beware the D-Link DIR-652, DIR-655, DIR-866L and DHP-1565 routers. They have critical bugs. An attacker halfway across the world could hijack these routers without needing a password. Everyone suggests throwing these routers away. I agree. End of Life is the techie term for the computing devices that are too old to bother with. As Seinfeld might have said: No bug fixes for you! Manufacturers win twice with routers that are deemed EoL: they don't have spend money fixing bugs and they motivate customers to buy new routers. Usually EoL devices are no longer sold. Not so with D-Link. Three of them can still be bought new from third-party sellers on Amazon's U.S. website. Is the same bug in any other D-Link routers? None of our business. Fortinet, which found the bug, does not say which or how many routers they tested. And, the D-Link response is limited to these four routers with no mention of any others.

• Multiple D-Link Routers Found Vulnerable To Unauthenticated Remote Code Execution by Thanh Nguyen Nguyen of Fortinet Oct. 3, 2019. This is the original bug report. The root cause is the lack of a sanity check for arbitrary commands executed by the native system command execution, which is a typical security pitfall suffered by many firmware manufacturers.
• DIR-866L Rev Ax, DIR-655 Rev. Cx, DHP-1565 Rev Ax, and (non-US) DIR-652 :: CVE-2019-16920 :: Unauthenticated Remote Code Execution (RCE) Vulnerability from D-Link. TL;DR Fuggedaboutit
• Legacy Products D-Link products that are EoL
• D-Link router remote code execution vulnerability will not be patched by Charlie Osborne Oct 7, 2019

SEPTEMBER 2019

Bugs Bugs Bugs - 125 in all

SOHOpelessly Broken 2.0
by Independent Security Evaluators   September 16, 2019
My summary is on the News page.

Here we go again - another LAN side protocol available on WAN

Protocol used by 630,000 devices can be abused for devastating DDoS attacks
by Catalin Cimpanu of ZDNet   August 27, 2019
Just as with UPnP all those years ago, routers (and IoT devices) are exposing a protocol meant exclusively for LAN-side use to the Internet at large. This time the protocol is WSD (a.k.a. WS-Discovery and Web Services Dynamic Discovery). Bad guys abuse WSD to create DDoS attacks. WSD listens on UDP port 3702 (some articles also referenced TCP port 3702). Like UPnP, WSD is a protocol for LAN side devices to discover each other and their capabilities. Is there a printer in the house? WSD communication starts with requests to the IPv4 multicast address 239.255.255.250. IPv6 uses FF02::C (link-local scope). Being exposed to the WAN is only one bug, the other is that devices should only respond to requests to these two IP addresses. WSD responses sometimes come from port 3702, sometimes from random high numbered ports. Akamai noted that most vulnerable devices were CCTV cameras and DVR systems. No article said anything about the failure of the routers to block these vulnerable devices. UPnP haunts us still.

• New DDoS Vector Observed in the Wild: WSD attacks hitting 35/Gbps by Jonathan Respeto of Akamai September 18, 2019
• New DDoS Attack-Vector via WS-Discovery/SOAPoverUDP, Port 3702 by Zero.bs August 2019
• Yikes! Another DDoS Weapon, WS-Discovery Amplification Attacks by A10 Networks September 5, 2019
• WS-Discovery Amplification Attack by A10 Networks September 2019
• Click here to test UDP port 3702 from your home.
• For good luck, also test TCP port 3702 from your home.
• Test UDP port 3702 from outside your home with: nmap -sU -p 3702 1.2.3.4
  where 1.2.3.4 is the public IP address of your router. The good STATE is Open|Filtered

AUGUST 2019

Four router vendors refuse to fix bugs

Cross-Router Covert Channels
by Adar Ovadya, Rom Ogen, Yakov Mallah, Niv Gilboa and Yossi Oren of Ben-Gurion University   August 2019
Researchers at Ben-Gurion University found multiple ways to communicate between the two Wi-Fi networks typically offered by a router. They refer to these two networks as Host and Guest, most people refer to them as Private and Guest. The research was presented at the 13th USENIX Workshop on Offensive Technologies (WOOT). They tested routers from TP-Link, D-Link, Edimax and Linksys and all the companies refused to fix anything. Quoting: "We sent a draft of our findings to the manufacturers of the routers ... during May 2019. During June 2019 the Belkin/Linksys security response team notified us that they do not intend to fix the vulnerability we disclosed. None of the other router vendors responded to our disclosure". As I say elsewhere on this site, don't use a consumer router. The bugs are pretty obscure. For example, on some routers, a DHCP NAK from one network is erroneously sent to the other network which can be used to send a small amount of data to the other network. They also discovered that quickly joining and leaving an IGMP group from the Private network caused an IGMP Membership Query packet to be sent to both the Private and Guest networks. This too can be used transfer data between the two networks. There were also some timing attacks.

• Router Network Isolation Broken By Covert Data Exfiltration by Ionut Ilascu of Bleeping Computer August 18, 2019
• Cross-Router Covert Channels the research paper as a PDF by Adar Ovadya, Rom Ogen, Yakov Mallah, Niv Gilboa and Yossi Oren of Ben-Gurion University

Bugs found in multiple 4G Hotspots

Reverse Engineering 4G Hotspots for fun, bugs and net financial loss
by G Richter of Pen Test Partners   August 10, 2019
A 4G hotspot is a router. The biggest difference is that it connects to the Internet via 4G rather than an Ethernet cable. Pen Test Partners found multiple vulnerabilities in several well known vendors Mi-Fi devices, including pre- and post-auth command injection and code execution. The vendors involved were generally poor at responding to disclosure attempts. ZTE was the worst, they responded that a device was end of life, so the bugs would not be fixed ... yet they were still selling it from their own online store! They also found bugs in Netgear and TP-Link devices.

• Hacking 4G hotspots – when did you last update? by Paul Ducklin of Sophos Aug. 12, 2019. Good article.

JUNE 2019

Critical bugs in four TP-Link Wi-Fi Range Extenders

Critical RCE Vulnerability in TP-Link Wi-Fi Extenders Can Grant Attackers Remote Control
by Grzegorz Wypych of Security Intelligence   June 18, 2019
Four TP-Link Wi-Fi extenders have a critical remote code execution (RCE) vulnerability. The bug lets a remote attacker get complete control over the device. The attacker does not need to login or authenticate to the device to exploit the bug. The problem is triggered with a malformed user agent field in HTTP headers. The buggy devices are the RE365 (sold in Europe), the RE650 (sold in the US, UK and Canada), the RE350 (same 3 countries) and the RE500 (sold in the US and Canada). Patches have been issued but device owners have to manually download them and install them. First, they have to insure the correct hardware version for the available firmware, then they have to get the firmware for their country. All processes on these devices run with root-level access which is just asking for trouble.

• Patch Your TP-Link Wi-Fi Range Extender Now by Paul Wagenseil June 18, 2019

Still another critical bug in Cisco software

Cisco IOS XE Software Receives Fix Against High-Severity Flaw
by Ionut Ilascu of Bleeping Computer   June 13, 2019
Far too much of this web page is devoted to bugs in Cisco software. They just released an updated version of their IOS XE operating system to patch a high severity bug - insufficient cross-site request forgery (CSRF) protections in the web-based user interface of the software. The bug can be exploited by an unauthenticated, remote attacker who could persuade an already logged in user of the web interface to follow a malicious link. The link could then perform arbitrary actions with the privilege level of the victimized user. If the victim is an administrator, bad guys could modify the configuration, run commands and even reload a vulnerable device. The good news is that a victim has to be logged in to the system before they can be exploited. Also, exploitation requires the HTTP Server feature to be active and it is not always active by default (this is version dependent).

• Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability from Cisco June 12, 2019

MAY 2019

Cisco screws up for the millionth time

Thrangrycat   by Red Balloon Security   May 21, 2019
Take a look at the bugs tracked on this site. Lots of Cisco issues over the last few years. Paraphrasing Red Balloon: There are two bugs that affect about 150 different Cisco devices. The first, known as Thrangrycat, allows an attacker to fully bypass the Trust Anchor module (TAm) via Field Programmable Gate Array (FPGA) bitstream manipulation. This is due to multiple hardware design flaws in the TAm. The second is a remote command injection vulnerability against IOS XE version 16 that allows remote code execution as root. By chaining these, an attacker can remotely and persistently bypass Cisco’s secure boot mechanism and lock out all future software updates to the TAm. The TAm is a proprietary Cisco hardware security module. It is the root of trust that underpins all other Cisco security mechanisms. Thrangrycat allows an attacker to make persistent modification to the TAm, thereby defeating the secure boot process and invalidating the chain of trust at its root. While the flaws are based in hardware, they can be exploited remotely. Since the flaws involve the design of the hardware, it is unlikely that any software patch will fully resolve the fundamental issues. Cisco released a patch for IOS XE and provided the Cisco IOS Software Checker to identify vulnerabilities in Cisco IOS and IOS XE. Cisco is working on patches for Thrangrycat, but notes that the patch will not be a straightforward update for most devices but instead will require "on-premise[s] reprogramming of a low-level hardware component." Patches for many routers, switches and network interface modules will be released between May 2019 and November 2019. As for detection and mitigation, Red Balloon will present this in a talk at BlackHat USA 2019.

• Thangrycat: a deadly Cisco vulnerability named after an emoji by Cory Doctorow May 22, 2019. Quoting: "Once this system is compromised, it can be forced to give false reports on the state of the system: for example, it might report that its OS has been successfully updated to patch a vulnerability when really the update has just been thrown away." Yikes.
• Cisco Secure Boot Hardware Tampering Vulnerability Last Updated: May 23, 2019. There are no workarounds available. Cisco says the bug is only vulnerable to local attackers. Interesting conflict with Red Balloon. "The vulnerability is due to an improper check on the area of code that manages on-premise updates to a Field Programmable Gate Array (FPGA) part of the Secure Boot hardware implementation ... A successful exploit could ... require a hardware replacement ... " Yikes again.
• The Internet Security Apocalypse You Probably Missed by Charlie Warzel and Sarah Jeong May 21, 2019. Here, the New York Times does what it does best, have unqualified people cover a tech story. They get an explanation of the problem, from Red Balloon targeted at 5 year old children. Beats me why the newspaper can't hire actual techies. Quoting their virtual child: " ... most [Cisco devices] ... have been compromised. And it’s not just something that a software update or patch can fix in a jiffy. This is structural. Which means that if things are compromised by attackers, they can’t be easily uncompromised ... Thrangrycat is awful for two reasons. First, if a hacker exploits this weakness, they can do whatever they want to your routers. Second, the attack can happen remotely ... But the fix can only be applied ... In person ... Thrangrycat only works once you have administrative access to the device. Unfortunately, Attack #1 is a garden variety vulnerability. Many systems don’t even have administrative access configured correctly." When the virtual 5 year-old says "compromised" it means "vulnerable"

TP-Link publicly shamed

Thousands of vulnerable TP-Link routers at risk of remote hijack
by Zack Whittaker of TechCrunch   May 22, 2019
Thousands of TP-Link routers are vulnerable to a bug, and it took more than a year for TP-Link to publish the patches on its website. They created the patches, they just didn't publish them. The bug lets a low-skilled attacker to get full remote access to a vulnerable router. The bug was first disclosed to TP-Link in October 2017. Shortly thereafter, they released a patch for the WR940N router. But, the WR740N was vulnerable to the same bug and no patch was released for it. TP-Link was warned about this in January 2018, yet ... nothing until they were publicly shamed by TechCrunch.

• Remote Code Execution (CVE-2017-13772) Walkthrough on a TP-Link Router by Tim Carrington of Fidus October 17, 2017. The bug.
• TP-Link kept thousands of vulnerable routers at risk of remote hijack, failed to alert customers by Vincy Davis of Packt May 23, 2019.

Linksys found to be both incompetent and unconcerned with security

Over 25,000 Linksys Smart Wi-Fi routers vulnerable to sensitive information disclosure flaw
by Troy Mursch   May 13, 2019
Thirty three Linksys routers are buggy and Linksys will not fix it. They tried to fix it five years ago, but they screwed that up. Yet another confirmation of the opinion I offered on this site from the get-go back in 2015 - avoid consumer routers. The flaw affects Linksys Smart Wi-Fi routers. It allows unauthenticated remote access to sensitive information and its easily exploited by bad guys with little technical knowledge. The routers leak information both about themselves and about every (yes, every) device that has ever connected to them. For connected devices, Linksys always leaks the MAC address, Device name ("TROY-PC") and Operating system. Sometimes it also leaks the device type, model number, and a description of the attached device. As for router information, it leaks the model number, hardware version, serial number, firmware release level, MAC address, the LAN side IP address, WAN settings, firewall status and DDNS settings. Leaking the MAC address lets bad guys determine the physical location of the router. Data provided by BinaryEdge, shows that 25,617 Linksys Smart Wi-Fi routers are currently leaking sensitive information to the public. Among the 33 buggy models are the E4200, EA2700, EA5800, EA6900, EA7300, EA8500, EA9200, WRT1900AC, WRT3200ACM, XAC1900 and WHW03 Velop. The full list is here. This is yet another in a long line of HNAP bugs. The bug can also reveal if a router is using the default password (thousands are) without even trying to login. The worst part is that Linksys tried to fix this five years ago but clearly screwed that up. Then, when contacted about it recently, they had no interest in fixing it properly. Yes, if you disable remote web access you block the information leak. However, Linksys Smart Wi-Fi routers require remote access for the Linksys App to function.

• Over 25k Linksys routers vulnerable to sensitive information disclosure flaw Comments at Hacker News
• Linksys Smart Wi-Fi Routers Leak Info of Connected Devices by Sergiu Gatlan of Bleeping Computer May 13, 2019
• 33 Linksys router models leak full historic record of every device ever connected by Dan Goodin in Ars Technica May 18, 2019. Best part of the article: "Ars emailed press representatives of Belkin, the company that acquired Linksys in 2013, seeking comment earlier this week and never received a response."

APRIL 2019

29 new Cisco Bugs

Cisco warns over critical router flaw
by Liam Tung of ZDNet   April 18, 2019
Cisco has disclosed 29 new vulnerabilities, 5, 6 or 7 of which are doozies. Its too much for tech reporters to digest. One of the critical bugs is in the ASR9000 Series Aggregation Services Routers. The bug is as bad as bad gets, it can be exploited remotely by a bad guy without a password. There is a patch and a workaround. The other critical bugs affect Cisco Wireless LAN Controller software. Another bug is in the Cisco Expressway Series and Cisco TelePresence Video Communication Server. Another biggie is in Cisco Aironet Series Access Points. Finally, there is a critical bug in the Cisco Cluster Management Protocol code in Cisco IOS and Cisco IOS XE. As with the first bug a remote bad guy without a password can obtain full control of vulnerable devices. If the devices accept Telnet connections, a bad guy who sends malformed Telnet options while establishing a connection can execute arbitrary code. The Threatpost article below offers some context, noting that earlier this month, Cisco re-patched flaws for two high-severity bugs after their first attempt was botched. And, they reported two new router bugs with no fixes or workarounds. Just what you want in a router vendor.

• Cisco Patches Critical Flaw In ASR 9000 Routers by Lindsey O'Donnell of Threatpost April 18, 2019
• Cisco warns WLAN controller, 9000 series router and IOS/XE users to patch urgent security holes by Michael Cooney of Network World April 18, 2019

TP-Link, yet again

Buffer Overflow Vulnerability in TP-Link Routers Can Allow Remote Attackers to Take Control
by Grzegorz Wypych and Limor Kessem of IBM Security Intelligence   April 8,2019
There is a buffer overflow flaw in the TP-Link TL-WR940N and TL-WR941ND routers. No other models were tested, so it is likely that others in the same family are vulnerable too. These models are old (they are 300Mbps Wi-Fi N) and have been discontinued. The bug allows bad guys to take control of the device from a remote location. Sounds worse than it is. You have to already be logged on to the web interface to exploit the flaw. And, the flaw is in the web interface, so if Remote Administration is disabled, as it often is, then it can not be exploited from overseas. TP-Link issued patches. Why are so many of these reports about ancient routers? Perhaps because if you break a $30 router while hacking it, no big deal.

• TP-Link Routers Vulnerable to Zero-Day Buffer Overflow Attack by Tom Spring of Threatpost April 8, 2019

Three bugs in a Verizon FIOS router

Verizon Fios Quantum Gateway Routers Patched for Multiple Vulnerabilities
by Tenable Research   April 9, 2019
Tenable has discovered 3 vulnerabilities in the Verizon Fios G1100 Quantum gateway/router. A Command Injection flaw can only be exploited by a user already logged on to the device. It is exploitable from the LAN side and remotely if Remote Administration is enabled. Because HTTPS is not enforced in the web interface, an attacker on the LAN side can intercept login requests using a packet sniffer and then replay the requests to get admin access to the web interface of the router. Packet sniffing a login request also provides a salted password hash (SHA-512). An unauthenticated attacker can retrieve the password salt simply by visiting a URL in a web browser. Thus, an attacker could perform an offline dictionary attack to recover the original password. Of course, the focus on passwords is because insecure firmware, like this, always uses the same userid. By now, most Verizon FIOS customers should have the updated firmware. If you have a G1100 you should verify this. The real lesson here is not use hardware from an ISP. See the Disclosure Timeline in the first article below and judge the Verizon repsonse for yourself.

• Verizon Fios Quantum Gateway Multiple Vulnerabilities by Tenable Research. Best part is the Disclosure Timeline and what it says about Verizon
• The Verizon Fios Quantum Gateway is sold for $200 by Verizon.
• Verizon Fios Router Authenticated Command Injection by Chris Lyne of Tenable April 9, 2019
• Verizon Fixes Bugs Allowing Full Control of Fios Quantum Router by Ionut Ilascu of Bleeing Computer April 9, 2019. Shows how to check the firmware release on the buggy gateway device.

MARCH 2019

TP-Link ignores a security problem

TP-Link 'smart' router proves to be anything but smart - just like its maker: Zero-day vuln dropped after silence
by Thomas Claburn of The Register   March 28, 2019
90 days ago Matthew Garrett, a Google employee, informed TP-Link of a bug in their all-in-one SR20 Smart Home Router. TP-Link ignored the problem. To me, this is the more important issue, much more interesting than the bug itself. Garret wrote: "I reported this to TP-Link in December via their security disclosure form, a process that was made difficult by the "Detailed description" field being limited to 500 characters. The page informed me that I'd hear back within three business days - a couple of weeks later, with no response, I tweeted at them asking for a contact and heard nothing back." The SR20 is a combination Zigbee/ZWave hub and router. Ignoring security problems is one of three mistakes TP-Link made. They also ship devices with debug daemons, software intended for testing, that does not belong in a released product. The software is the TP-Link Device Debug Protocol (tddp) and it has had multiple vulnerabilities in the past. This bug allows allows arbitrary command execution, as root, without authentication, from devices on the LAN. TDDP listens on the WAN side too, but the default firewall configuration blocks it there. To better control access to the router from LAN-side devices see the Local Administration section of my security checklist. Garrett also said that @CoreSecurity had the same experience when they reported TDDP flaws.

• Remote code execution as root from the local network on TP-Link SR20 routers by Matthew Garrett March 28, 2019
• TP-Link router zero-day that offers your network up to hackers by Paul Ducklin April 2, 2019. Excellent article. Worth reading even if you do not own TP-Link devices.
• Zero-Day TP-Link SR20 Router Vulnerability Disclosed by Google Dev by Sergiu Gatlan of Bleeping Computer March 28, 2019

FEBRUARY 2019

Bugs in two D-Link routers found by the BSI in Germany

D-Link investigates router vulnerability after German security agency warning
by CET news   March 1, 2019
D-Link is investigating bugs in the DIR-825 and DIR-878 after a warning from the German Federal Office for Information and Security (BSI). The BSI assigned a severity rating of "high". The bugs allow attackers to bypass the logon processes and execute malicious code. The bugs are easily exploited. The DIR-825 got its last update in 2015, the DIR-878 was last updated in August 2018. My guess (time will tell) is that these bugs will not be fixed.

• Zwei D-Link-Router warten auf Sicherheitsupdates by Dennis Schirrmacher of Heise March 1, 2019 In German.
• Vulnerabilities in D-Link routers DIR-825 and DIR-878 by D-Link in German Feb 28, 2019. They are looking into it. Check their website for updates. Where on the website? They don't say. Which website? They don't say.
• D-Link DIR-825 Rev.B 2.10 router_info.xml information disclosure Feb. 25, 2019. CVE-2019-9126 is an information disclosure vulnerability in the D-Link DIR-825. Requests for file router_info.xml reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN information of the device.
• D-Link DIR-825 Rev.B 2.10 ntp_sync.cgi ntp_server privilege escalation Feb. 25, 2019. CVE-2019-9122 is a critical bug that lets remote attackers execute arbitrary commands via the ntp_server parameter in an ntp_sync.cgi POST request.

JANUARY 2019

Can Cisco be trusted?

Multiple vulnerabilities in Cisco Identity Services Engine (Unauth XSS to RCE as root)
by Pedro Ribeiro of Agile Information Security and Dominik Czarnota   First published Jan 20, 2019, Last Updated Feb 5, 2019
I don't care much about the details here, and the bugs are not in a router. But Cisco makes routers and the bigger issue, to me, is just how trustworthy Cisco is. They appear on this bug list often. Would you buy a router from them? Quoting: "ISE is distributed by Cisco as a virtual appliance. We have analysed version 2.4.0.357 and found three vulnerabilities ... By putting them all together, we can achieve remote code execution as root, provided we can trap an administrator into visiting the page vulnerable to the stored cross site scripting." Agile dealt with Cisco about these bugs and it did not go well, leading to Ribeiro saying "These actions show Cisco is incredibly negligent with regards to the security of their customers. They are still shipping (and recommending) a product version vulnerable to unauthenticated remote code execution, with a fully working public exploit and no way to track fixes or fixed versions for these vulnerabilities." Ouch.

• Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities by Cisco. First published January 9, 2019. Are the bugs fixed? You have to be Cisco customer to find out. That is not what trustworthy companies do.

Three bugs in two Cisco routers

Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
a Cisco Security Advisory   January 23, 2019
This happened fast. In September 2018, three bugs were reported to Cisco by German security firm RedTeam Pentesting. Cisco released patches for the bugs on January 23, 2019. The next day, proof of concept software was released that exploited the bugs. The day after that, bad guys were scanning for vulnerable Cisco routers. The bugs are exploitable on both the LAN and WAN side using just HTTP and/or HTTPS GET requests. The first two bugs expose information about the router to anyone who asks - no password is needed. One of these bugs exposes the Admin password. With that, bad guys can abuse the third bug to run any Linux command on the box. The vulnerable URLs are
   http://1.2.3.4/cgi-in/config.exp   and
   http://1.2.3.4/cgi-bin/export_debug_msg.exp
where 1.2.3.4 is either the LAN side or WAN side IP address of the router. The bugs are CVE-2019-1653 and CVE-2019-1652. The Cisco RV320 and RV325 routers are popular among both ISPs and large enterprises. On the WAN side, the web interface is exposed on TCP port 8007. Information about attacks on these bugs is on the News page.

• Cisco RV320 Unauthenticated Diagnostic Data Retrieval by RedTeam Pentesting about a bad URL part of CVE-2019-1653 Jan. 23, 2019
• Cisco RV320 Unauthenticated Configuration Export by RedTeam Pentesting about a second bad URL part of CVE-2019-1653 Jan. 23, 2019
• Cisco RV320 Command Injection by RedTeam Pentesting about CVE-2019-1652 the command injection bug Jan. 23, 2019
• CiscoRV320Dump exploit code by David Davidson
• Public Exploit Scripts for Vulnerable Cisco Small Business RV320 and RV325 Devices Now Available by Satnam Narang of Tenable January 25, 2019. This article explains how the encryption protecting the Admin user password was poor: "... hashed credentials for the router, which are trivially hashed using MD5. The md5 hash is md5($password.$auth_key), with the auth_key being a static value that can be readily found by running "GET /" and parsing the output. "
• The Cisco Rv320 was released in June 2013 and now sells for about $140. It is a dual WAN VPN router (no Wifi) supporting SSL, PPTP and IPSec VPNs.

Many Cisco switches have a backdoor account

Critical, Unpatched Cisco Flaw Leaves Small Business Networks Wide Open
by Tara Seals of Threatpost   January 18, 2019
These Cisco Small Business switches are vulnerable to full remote takeover thanks to a backdoor account: the 200 and 250 Series Smart Switches, the 300 and 350 Series Managed Switches, the 350X, 500 and 550X Series Stackable Managed Switches. There is no patch, but there is a work-around. The most interesting question is whether this is a bug or a feature. It looks like a bug in that it has an official CVE number (CVE-2018-15439) and a critical base CVSS severity rating of 9.8 (really bad). The devices ship with an in-built privileged user account that is used for the initial login. This account can not be removed. It is defined in a software-internal data structure and its not visible in either the running configuration or the startup configuration of an affected device. Bad guys can use this account to log in to a vulnerable device and execute commands with full admin privileges. The work-around is creating a user account with access privilege level of 15 (or higher?). But, if that account gets deleted, the hidden one works again, without notifying system administrators. It sure feels like a back door that can be easily hidden in case the virtual cops are coming. Why else hide the existence of this in-built account? Also, there have been many other backdoors discovered in Cisco software over the last year or so. It has been about 3 months and still no patch.

• Cisco Small Business Switches Privileged Access Vulnerability Cisco Security Advisory. Initially released Nov. 7, 2018 Last updated Jan. 16, 2019
• Security Now podcast with Steve Gibson, Show 698 recorded Jan. 22, 2019. Gibson felt that this is a feature, not a bug, saying "This sounds deliberate". He even objected to Cisco referring to this as a vulnerability.

---