Home
 » ISP News » 
Sponsored Links

Masses of Broadband Routers Still Vulnerable to Directory Traversal Hack

Friday, Mar 20th, 2015 (8:45 am) - Score 2,475

One of Cisco Systems better known Penetration Tester’s, Kyle Lovett, has this week warned a UK security conference that more than 700,000 ADSL broadband routers from various different manufacturers and countries are still vulnerable to a Directory Traversal attack that was first uncovered in 2011.

A Directory Traversal attack is a form of HTTP exploit, which usually only requires a web browser to launch the assault and a bit of knowledge about where the files and directories are on the system being targeted. A hacker can then use the browser to access data in a directory other than the servers / routers root directory and, if successful, they would be able to view or possibly even execute restricted commands and files.

Advertisement

Successfully exploiting a Directory Traversal vulnerability is in many cases enough to give the attacker almost total control of a router, which means they can do everything from hijacking your DNS (website etc.) requests to snooping on your personal data and various other nasty things.

Lovett expanded upon the approaches first used here and then more recently here (CVE-2014-2962) in order to extract an important file called config.xml, which was present on most of the affected routers. As the name might suggest, the file contains a lot of configuration settings (e.g. login and password for the ADSL / ISP connection, wifi network password, client and server credentials for the TR-069 remote management and more).

The passwords hashes (encryption) listed in the above file were, on a lot of devices, apparently quite weak and this meant they were easy to crack. Naturally once somebody has the passwords for your device then it’s often game over. Worrying Lovett noted that some routers even allowed him to access the config.xml simply by typing the correct URL (no real hacking required), although he didn’t say which ones.

According to PC World, Lovett scanned the Internet using SHODAN and claims to have identified 700,000 routers that could be vulnerable to the same attack, including various models from ZTE (e.g. H108N and H108NV2.1), D-Link (2750E, 2730U and 2730E), Sitecom, FiberHome, Digisol and more. But the number could potentially be higher since SHODAN only revealed those that could be targeted remotely because their web-based admin interface was exposed to the Internet.

Advertisement

Interestingly most of the routers were running firmware developed by China-based Shenzhen Gongjin Electronics (aka T&W), which also does manufacturing work for Asus, Alcatel-Lucent, Belkin, ZyXEL and Netgear. So far the company has not responded to Lovett or any media requests for comment, which doesn’t inspire confidence.

One bit of good news is that most of the vulnerable ADSL routers are supplied by ISPs in South America and South East Asia, with only a few spotted in the USA and other European countries (most of the latter were third-party purchases and not ISP supplied). In other words those with ISP supplied broadband routers in the UK should be fairly safe, but there’s no guarantee.

Tags:
Mark-Jackson
By Mark Jackson
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on X (Twitter), Mastodon, Facebook, BlueSky, Threads.net and .
Search ISP News
Search ISP Listings
Search ISP Reviews

Comments are closed

Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
200Mbps
Gift: None
Youfibre UK ISP Logo
Youfibre £23.99
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £23.99
132Mbps
Gift: None
Plusnet UK ISP Logo
Plusnet £24.99
145Mbps
Gift: £145 Reward Card
NOW UK ISP Logo
NOW £25.00
100Mbps
Gift: None
Large Availability | View All
Cheap Unlimited Mobile SIMs
iD Mobile UK ISP Logo
iD Mobile £16.00
Contract: 24 Months
Data: Unlimited
Talkmobile UK ISP Logo
Talkmobile £16.95
Contract: 1 Month
Data: Unlimited
Smarty UK ISP Logo
Smarty £17.00
Contract: 1 Month
Data: Unlimited
ASDA Mobile UK ISP Logo
ASDA Mobile £19.00
Contract: 24 Months
Data: Unlimited
Three UK ISP Logo
Three £20.00
Contract: 24 Months
Data: Unlimited
Cheapest ISPs for 100Mbps+
toob UK ISP Logo
toob £18.00
150Mbps
Gift: None
Gigaclear UK ISP Logo
Gigaclear £19.00
300Mbps
Gift: None
Community Fibre UK ISP Logo
200Mbps
Gift: None
Beebu UK ISP Logo
Beebu £23.00
100 - 160Mbps
Gift: None
Hey! Broadband UK ISP Logo
150Mbps
Gift: None
Large Availability | View All
Promotion
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms , Privacy and Cookie Policy , Links , Website Rules , Contact
Mastodon