Menu
Popular Belkin Wi-Fi routers plagued by unpatched security flaws

Popular Belkin Wi-Fi routers plagued by unpatched security flaws

Attackers could exploit the flaws to hijack DNS requests or completely take over the devices

If your Wi-Fi network is using the popular Belkin N600 DB router, be warned: it may have several vulnerabilities that could allow hackers to take it over.

Remote unauthenticated attackers could exploit the vulnerabilities to spoof DNS (Domain Name System) responses and direct users to rogue websites or trick users' browsers to change the device configuration, the CERT Coordination Center (CERT/CC) at Carnegie Mellon University said Monday in an advisory.

Furthermore, attackers with access to the local area network could bypass an affected router's authentication and take complete control over it, CERT/CC said.

Exploiting some of the vulnerabilities requires attackers to be in a man-in-the-middle position between the router and its DNS servers or Belkin's update servers. However, other flaws can be exploited by tricking users on the local network to visit specially crafted Web pages or by infecting their computers with malware.

The Web-based attack technique is known as cross-site request forgery (CSRF) and is an abuse of the way browsers are designed to work. A website has the ability to force a browser to send a request to a third-party website and this can be a router's administrative interface that's only accessible over the local network.

By default, the Belkin N600 doesn't require a password for accessing the management interface, so potential CSRF attacks against such devices might not even require users to be authenticated.

Router manufacturers are often quick to point out that flaws in their devices' Web-based management interfaces cannot be attacked remotely because those interfaces are not exposed to the Internet by default.

However, they rarely mention CSRF, an attack vector that hackers are increasingly using against home routers, including in large-scale campaigns launched through legitimate websites.

CERT/CC confirmed the vulnerabilities in the 2.10.17 firmware of the Belkin N600 DB F9K1102 v2 model, but noted that earlier versions are also possibly affected.

The organization is not aware of any patches available from the vendor and advises users to take general security precautions like setting strong passwords for the router's management interface and Wi-Fi network and only allowing trusted computers on the LAN.

Users behind these routers should never browse the Internet while the Web management interface has an active session in a browser tab, CERT/CC said.

There are no practical workarounds for the DNS spoofing or firmware over HTTP issues and no way to prevent attackers from exploiting the authentication bypass vulnerability once they have access to the local network, the organization warned.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments