Critical RCE Bug Affects Millions of OpenWrt-based Network Devices

guest · Mar 25, 2020

Critical RCE Bug Affects Millions of OpenWrt-based Network Devices
March 25, 2020
https://securityaffairs.co/wordpress/100400/hacking/critical-rce-openwrt-devices.html

Earlier this year, security expert Guido Vranken from the software firm ForAllSecure, discovered a critical vulnerability in the OpenWrt Linux-based operating system for network devices.

The flaw tracked as CVE-2020-7982 is a critical remote code execution vulnerability affecting the operating system, which is a widely used Linux-based operating system for network devices such as routers and residential gateways.
The vulnerability exists in the OPKG package manager of OpenWrt, it is related to the way it performs integrity checking of downloaded packages using the SHA-256 checksums that are embedded in the signed repository index.

“For exploitation it is required that the attacker serves (compromised) packages from a web server. The attacker must either be in a position to intercept and replace communication between the device and downloads.openwrt.org, or control the DNS server used by the device to make downloads.openwrt.org point to a web server controlled by the attacker.” reads a post published by the expert.
Click to expand...

Log in or Sign up

Critical RCE Bug Affects Millions of OpenWrt-based Network Devices

guest Guest

Log in or Sign up

Critical RCE Bug Affects Millions of OpenWrt-based Network Devices

guest Guest

Useful Searches