Multiple Modem Routers Vulnerable to Unauthenticated Attacks

guest · Jul 21, 2021

Multiple Modem Routers Vulnerable to Unauthenticated Attacks
July 21, 2021
https://www.technadu.com/multiple-modem-routers-vulnerable-to-unauthenticated-attacks/290716/

A large set of modem routers from nine vendors are vulnerable to remote unauthenticated access.

Some of these vendors have addressed the problem with a fixing patch, but not every model is covered.

Applying any available firmware updates and disabling remote WAN access to the admin panel is advisable.

Click to expand...

Researchers warn about a critical path traversal vulnerability affecting modems made by Arcadyan which use the same buggy firmware. The flaw is being tracked as CVE-2021-20090 and has a CVSS v3 score of 8.1 (critical). The vulnerability allows an attacker to bypass authentication on a target device remotely, potentially accessing private pages, sensitive information, tokens, or even altering the router settings. The discovery of this comes from the Tenable team, who also found two more flaws (91 and 92) that have a more limited impact (only Buffalo WSR-2533DHPL2).

The modem router devices that are vulnerable to CVE-2021-20090 are the following: [...]
Click to expand...

The more digging they did, the more device models and vendors were added to the list, and today, the advisory is considered to have its final form, including a total of nine modem router vendors.
Click to expand...

Tenable: Multiple Vulnerabilities in Buffalo and Arcadyan manufactured routers

Tenable has discovered multiple vulnerabilities in routers manufactured by Arcadyan.

During the disclosure process for the issues discovered in the Buffalo routers, Tenable discovered that CVE-2021-20090 affected many more devices, as the root cause of the vulnerability exists in the underlying Arcadyan firmware.

Please note that CVE-2021-20091 and CVE-2021-20092 have only been confirmed on Buffalo WSR-2533 models.
Customers should seek update and mitigation information from their respective vendors.
Click to expand...

guest · Jul 21, 2021

Arcadyan-based routers and modems vulnerable to authentication bypass
Vulnerability Note VU#914124
July 20, 2021
https://kb.cert.org/vuls/id/914124

Overview
A path traversal vulnerability exists in numerous routers manufactured by multiple vendors using Arcadyan based software. This vulnerability allows an unauthenticated user access to sensitive information and allows for the alteration of the router configuration.
Description
The vulnerability, identified as CVE-2021-20090, is a path traversal vulnerability. An unauthenticated attacker is able to leverage this vulnerability to access resources that would normally be protected. The researcher initially thought it was limited to one router manufacturer and published their findings, but then discovered that the issue existed in the Arcadyan based software that was being used in routers from multiple vendors.
Click to expand...

Impact
Successful exploitation of this vulnerability could allow an attacker to access pages that would otherwise require authentication. An unauthenticated attacker could gain access to sensitive information, including valid request tokens, which could be used to make requests to alter router settings.
Click to expand...

guest · Aug 5, 2021

Decade-long vulnerability in multiple routers could allow network compromise
Devices using Arcadyan software are at risk
August 4, 2021
https://portswigger.net/daily-swig/...ltiple-routers-could-allow-network-compromise

A 12-year-old authentication bypass vulnerability that could allow attackers to compromise networks and devices has been discovered in at least 20 router models, potentially affecting millions of users.

Discovered by Evan Grant of Tenable, the critical path traversal flaw is tracked as CVE-2021-20090, with a CVSS of 9.8, and is exploitable by unauthenticated, remote attackers.
Grant found the issue, which has been present for at least 12 years, in Buffalo routers, specifically the Arcadyan-based web interface software.
Click to expand...

Two other vulnerabilities, CVE-2021-20091 and CVE-2021-20092, were found that currently are only known to affect specific Buffalo routers.
Grant told The Daily Swig: “CVE-2021-20091 would allow an authenticated attacker (or one leveraging the aforementioned authentication bypass) to gain root access to the device by injecting a line into the router’s configuration file, which enables the telnet service upon reboot.

In a blog post, the researcher explained that one of the first things he looks at while analyzing any web application or interface is how it handles authentication.
Click to expand...

More vulnerable devices
After confirming the vulnerability was present in the Buffalo router, Grant said that he discovered it also affected at least 20 other models.

“This [vulnerability] appears to be shared by almost every Arcadyan-manufactured router/modem we could find, including devices which were originally sold as far back as 2008,” wrote Grant.
“There is a much larger conversation to be had about how this vulnerability in Arcadyan’s firmware has existed for at least 10 years and has therefore found its way through the supply chain into at least 20 models across 17 different vendors,” Grant wrote.

He told The Daily Swig that the vulnerabilities were “fairly easy to discover” and “trivial to exploit.
Click to expand...

guest · Aug 7, 2021

Actively exploited bug bypasses authentication on millions of routers
August 7, 2021
https://www.bleepingcomputer.com/ne...passes-authentication-on-millions-of-routers/

Threat actors actively exploit a critical authentication bypass vulnerability impacting home routers with Arcadyan firmware to take them over and deploy Mirai botnet malicious payloads.

The vulnerability tracked as CVE-2021-20090 is a critical path traversal vulnerability (rated 9.9/10) in the web interfaces of routers with Arcadyan firmware that could allow unauthenticated remote attackers to bypass authentication.
The ongoing attacks were discovered by Juniper Threat Labs researchers while monitoring the activity of a threat actor known for targeting network and IoT devices since February.
Click to expand...

Millions of routers likely exposed to attacks
Vulnerable devices include dozens of router models from multiple vendors and ISPs, including Asus, British Telecom, Deutsche Telekom, Orange, O2 (Telefonica), Verizon, Vodafone, Telstra, and Telus.
A list of all known affected devices and vendors (including vulnerable firmware versions) is embedded below.
Attacks start two days after PoC exploit release
Since Thursday, Juniper Threat Labs "identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in Wuhan, Hubei province, China."
Click to expand...

Log in or Sign up

Multiple Modem Routers Vulnerable to Unauthenticated Attacks

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Multiple Modem Routers Vulnerable to Unauthenticated Attacks

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches