Embedded insecurity: Broadcom SDK vulnerabilities create lingering risk for router manufacturers

guest · Oct 5, 2021

Embedded insecurity: Broadcom SDK vulnerabilities create lingering risk for router manufacturers
Genesis of ‘forever-day’ vulnerability in Cisco business-grade router line uncovered
October 5, 2021
https://portswigger.net/daily-swig/...reate-lingering-risk-for-router-manufacturers

The rediscovery of vulnerabilities in wireless chip firmware technology from Broadcom has revealed how inherited security flaws can get baked into networking technology.

Security researchers at IoT Inspector discovered that although Broadcom (silently) patched vulnerabilities in its software development kit (SDK) for its chipsets as early as 2011, they still affected devices released years later by major vendors such as Cisco, DD-WRT, and Linksys (a brand owned by Cisco until 2013, when the line was bought by Belkin).

“As the affected Cisco devices are end of life, those issues will remain forever-days,” Florian Lukavsky, managing director of IoT Inspector.
Click to expand...

The Germany-based security consultancy uncovered flaws in the Universal Plug and Play (UPnP) implementation of Broadcom’s SDK while developing detection rules for Broadcom binaries, as revealed in a technical blog post today (October 5).

Subsequent detective work led to the discovery of CVE-2021-34730, an unauthenticated remote code execution (RCE) flaw affecting Cisco RV110, RV130, and RV215, a range of routers aimed at meeting the needs of smaller businesses.
Click to expand...

Log in or Sign up

Embedded insecurity: Broadcom SDK vulnerabilities create lingering risk for router manufacturers

guest Guest

Log in or Sign up

Embedded insecurity: Broadcom SDK vulnerabilities create lingering risk for router manufacturers

guest Guest

Useful Searches