Its routers ASUS contain a vulnerability that turns users into admins, according to the researcher security Joshua Drake.
Routers could be exploited by malicious local users, but not by those on the wider internet. After the intervention of the malicious user the router could send the network users using it to malicious ones websites.
Drake says to a publication that many popular models such as RT-N66 and RT-AC66U are affected.
"Currently, all known versions of the firmware used in these routers are considered vulnerable," Drake said.
[tweet_embed id = 552292584450969600]
The wrong code that enables command execution is in the service infosvr, which runs as root and is listened on UDP port 9999. The service is designed, as Drake mentions, to simplify router configuration by locating local routers.
Administrators should remove infosvr remote command execution or close the service from their firewall as their local area network passwords are not secure.
