The DHS notes that information about the vulnerabilities are incomplete as they’re both currently undergoing analysis. Depending on the model, additional ports may be exposed by default as well.". Port 10000 both expose the administrative web interface to WAN users. "he router exposes multiple ports to the WAN by default.
It added that the flaws could be exploited by an attacker on the wide area network (WAN).
Depending on the JNAP action that is called, the attacker may be able to read or modify sensitive information on the router,” the CERT said. “A remote, unauthenticated user can issue various JNAP calls by sending specially-crafted HTTP POST requests to http(s):// /JNAP/. Read more The week in security: WireLurker penetrates Apple defences, SMBs face shadow-IT threat The second flaw, assigned the identifier CVE-2014-8244, is remotely exploitable and may allow an attacker to “read of modify sensitive information on the router”. htpasswd file contains the MD5 hash of the administrator password,” explained Carnegie Mellon’s CERT. htpassword file by requesting http(s):// /.htpasswd. “An unauthenticated attacker on the local area network (LAN) can read the router's.
UPDATE LINKSYS ROUTER PASSWORD
The first flaw, officially designated as CVE-2014-8243, relates to key management errors in the firmware that potentially expose the router’s password file to an attacker who’s on the same local area network. The CERT pointed to two separate flaws affecting SMART wifi firmware that can be exploited locally and remotely. The problem, which resides in the firmware, is that Linksys only released a fix for eight of the affected devices.
Carnegie Mellon University’s computer emergency response team (CERT), a DHS sponsored unit, on Friday drew attention to patches for two flaws affecting 10 Linksys devices running its SMART wifi firmware - a feature introduced in 2012 which allowed owners of Linksys EA series routers to remotely control their home network via a smartphone app.
0 kommentar(er)
