Multiple Modem Routers Vulnerable to Unauthenticated Attacks
- A large set of modem routers from nine vendors are vulnerable to remote unauthenticated access.
- Some of these vendors have addressed the problem with a fixing patch, but not every model is covered.
- Applying any available firmware updates and disabling remote WAN access to the admin panel is advisable.
Researchers warn about a critical path traversal vulnerability affecting modems made by Arcadyan which use the same buggy firmware. The flaw is being tracked as CVE-2021-20090 and has a CVSS v3 score of 8.1 (critical). The vulnerability allows an attacker to bypass authentication on a target device remotely, potentially accessing private pages, sensitive information, tokens, or even altering the router settings. The discovery of this comes from the Tenable team, who also found two more flaws (91 and 92) that have a more limited impact (only Buffalo WSR-2533DHPL2).
The modem router devices that are vulnerable to CVE-2021-20090 are the following:
Tenable found out about this in January 2021 and reported the issue to the manufacturers in the months that followed. The more digging they did, the more device models and vendors were added to the list, and today, the advisory is considered to have its final form, including a total of nine modem router vendors.
The solution to the problem can only come via firmware updates, but this hasn’t been made available by all vendors and for all of the affected models. In some cases, we’re talking about EOL products, so these will have to be replaced by new ones. If you’re using any of the modems presented in the list, go ahead and check for any available firmware updates. If you’re running a vulnerable version and there’s no patch available to apply, you should be able to mitigate the risk by disabling the WAN-side administration services on your router as well as the web interface on the WAN.
As always, keep an eye on your modem vendor’s security advisory page and apply patches as soon as they’re made available. Now that the flaw has been published, malicious hackers will start scanning for vulnerable endpoints, so the exploitation rate will pick up. Hopefully, it won’t be long before most vendors respond with fixing action, but addressing the problem requires the end user's involvement. Unfortunately, there are millions affected by this flaw. This is why the CERT Coordination Center is now taking part in the effort to communicate the problem widely.