- This topic has 7 replies, 2 voices, and was last updated 3 years, 8 months ago by
.
-
Threat actors actively exploit a critical authentication bypass vulnerability impacting home routers with Arcadyan firmware to take them over and deploy Mirai botnet malicious payloads.
The vulnerability tracked as CVE-2021-20090 is a critical path traversal vulnerability (rated 9.9/10) in the web interfaces of routers with Arcadyan firmware that could allow unauthenticated remote attackers to bypass authentication.
Millions of routers likely exposed to attacks
Vulnerable devices include dozens of router models from multiple vendors and ISPs, including Asus, British Telecom, Deutsche Telekom, Orange, O2 (Telefonica), Verizon, Vodafone, Telstra, and Telus.Based on the number of router models and the long list of vendors impacted by this bug, the total number of devices exposed to attacks likely reaches millions of routers.
The security flaw was discovered by Tenable, which published a security advisory on April 26 and added proof of concept exploit code on Tuesday, August 3.
“This vulnerability in Arcadyan’s firmware has existed for at least 10 years and has therefore found its way through the supply chain into at least 20 models across 17 different vendors, and that is touched on in a whitepaper Tenable has released,” explained Evan Grant, Tenable Staff Research Engineer, on Tuesday.
Attachments:
In a completely sane world, madness is the only freedom (J.G.Ballard).
You need to login in order to vote
DSL-AC88U – R.I.P
Arcadyan make lots of routers for ASUS, but luckily only Firmware created by Arcadyan is at fault.
http://en.techinfodepot.shoutwiki.com/wiki/Arcadyan
In a completely sane world, madness is the only freedom (J.G.Ballard).
You need to login in order to vote
Speaking with ASUS today, in theory Arcadyan are obliged to supply a security hotfix for all their products, as this is classed as a ‘major security issue’, so will be interesting to see if the DSL-AC88U receives an update also
In a completely sane world, madness is the only freedom (J.G.Ballard).
You need to login in order to vote
ASUS have released a new firmware for the DSL-AC88U
Version 1.10.08_Build593
2021/08/25Change Log:
ASUS DSL-AC88U Firmware version v1.10.08_Build593 (This product supports Annex A)
Fixed CVE-2021-20090—–
Alas, I discussed this with ASUS previously. this only covers the Security vulnerability that allows Bypass Authentication.
CVE-2021-20090 – https://www.tenable.com/cve/CVE-2021-20090
In a completely sane world, madness is the only freedom (J.G.Ballard).
You need to login in order to vote
This is crazy after how many years???? Better late than never though.You need to login in order to vote
In a completely sane world, madness is the only freedom (J.G.Ballard).
You need to login in order to vote
This is crazy after how many years???? Better late than never though.
- You must be logged in to reply to this topic.