News

Watch out! A bug allows anyone to take control of your router

Published

2 years ago

January 11, 2022

Robert Adams

The vulnerabilities in routers they are one of the most serious that can be found. Our network devices They are the door that opens our home to the Internet, and a failure in them can put all our devices and our data at risk. Now, millions of routers are affected by a vulnerability discovered in a module used by major manufacturers.

The discovered vulnerability is present in the kernel module called KCodes NetUSB. You have been assigned the code CVE-2021-45388, and has been rated as high risk, as it allows remote code execution on unpatched devices. The vulnerability has been found by researchers from SentinelOne, who have published all the information regarding the vulnerability.

The failure affects whether the router has a USB port

The failure affects a multitude of routers that include a USB port, which are the vast majority. Through those USB ports of the router, it is possible to connect devices such as printers, hard drives or pen drives. Although the speed is more limited, it is a convenient way to access devices from anywhere on the network.

To get all the juice out of those USB ports, manufacturers have a kernel module called NetUSB, developed by KCodes. This connectivity module allows network devices to access remotely to interact with the USB devices that we have connected to the router. However, there is a very dangerous vulnerability in your code.

netusb hack

Specifically, it appears that the kernel module which does not validate the size value of the kernel memory allocations, resulting in an integer overflow. This overflow allows an attacker to remotely insert code to carry out malicious activities on our network.

The attack, however, has some limitations in how to exploit it. Despite this, the module has an expiration time of 16 seconds, giving more flexibility when exploiting a router. Exploiting vulnerability is difficult, but not impossible, hence SentinelOne recommends all affected manufacturers to update their routers immediately.

Manufacturers of affected routers

Specifically, among the affected manufacturers we find Netgear, TP-Link, Tenda, EDiMAX, and DLink, in addition to a Western digital, whose network hard drives also use these network modules. Researchers have not detailed the affected models, but if they have USB ports, they are most likely affected.

SentinelOne contacted KCodes on September 9, and they sent them a code that demonstrated the vulnerability on October 4 to verify the patch released that same day. The rest of the manufacturers were contacted in November, and the first patches They started arriving in December. Netgear released a patch for the D7800, R6400v2 and R6700v3 devices, where, as a workaround, they have changed a feature that prevents permissionless writing outside the limits set by the router.

The rest of the manufacturers have not reported having patched vulnerabilities, so it will probably take a little longer to do so. SentinelOne has found no evidence that attackers are currently exploiting the vulnerability, but now that it is public, they could begin exploiting it soon.

Phones

Redmi K70 Pro presented: an AI smartphone with a super-bright, flicker-free screen, record-breaking (for Redmi) performance and a brand new camera

Published

10 mins ago

November 29, 2023

Jeff Tucker

Today in China, Redmi officially introduced the new flagship Redmi K70 Pro. This is the brand’s first smartphone based on the Qualcomm Snapdragon 8 Gen 3 single-chip system.