Its routers ASUS contain a vulnerability that turns users into admins, according to security researcher Joshua Drake.
Routers could be exploited by malicious local users, but not by those on the wider internet. After the intervention of the malicious user the router could send the network users using it to malicious ones websites.
Drake says to a publication that many popular models such as RT-N66 and RT-AC66U are affected.
"Currently, all known versions of the firmware used in these routers are considered vulnerable," Drake said.
[tweet_embed id = 552292584450969600]
The wrong code that enables the implementation command line is in the infosvr service, which runs as root and is listened on UDP port 9999. The service is designed, as Drake mentions, to simplify router configuration by detecting local routers.
Οι διαχειριστές θα πρέπει να καταργήσουν τη λειτουργία απομακρυσμένης εκτέλεσης εντολών από το infosvr ή να κλείσουν το service από το τείχος προστασίας τους, καθώς οι κωδικοί πρόσβασης τους σε τοπικά networks they are not safe.
