Vulnerable DD-WRT Firmware Exposes Wireless Routers
A hacker has discovered a critical vulnerability in open-source firmware available for wireless routers made by Linksys and other manufacturers that allows attackers to remotely penetrate the device and take full control of it.
The remote root vulnerability affects the most recent version of DD-WRT, a piece of firmware many router users install to give their device capabilities not available by default. The bug allows unauthenticated users to remotely gain root access simply by luring someone on the local network to a malicious website.
The bug resides in DD-WRT’s hyper text transfer protocol daemon, which runs as root. Because the httpd doesn’t sanitize user-supplied input, it’s vulnerable to remote command injection. While the httpd doesn’t listen on the outbound interface, attackers can easily access it using CSRF (cross-site request forgery) techniques.
What’s more, exploits need not be part of an authenticated session, making them easy to carry out. Examples of URLs that allow remote takeover include http://routerIP/cgi-bin/;command_to_execute
or even http://192.168.0.1/cgi-bin/;CMD
DD-WRT is open-source firmware that runs more than 200 different models of wireless routers and embedded devices, including those made Linksys, D-Link, Buffalo, and Netgear.
Temporal fix is available here.
Credit: The Register
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.