A security researcher has discovered several vulnerabilities in any Ruckus wireless routers, which the networking monster has for patched.
Gal Zror said TechCrunch that the vulnerabilities he noticed lying within in the web user interface software that runs on the company’s Unleashed line of routers.
The flaws can be utilized externally needing a router’s password and can be done to take total control of modified routers from over the internet.
Routers act as a gateway between a home or office network and the wider internet. Routers are also the main line of protection upon unapproved entrance to that network. But routers can be an only point of failure.
If enemies find and take pleasure from vulnerabilities in the router’s software, they can manage the device and get entrance to the wider internal network, exposing computers and other devices to hacks and data stealing.
Zror said his three vulnerabilities can be used to obtain “root” prerogatives on the router — the highest level of access — allowing the attacker unfettered way to the device and the network.
Although the three vulnerabilities vary by the difficulty to utilize, the most obvious of the vulnerabilities does simply a single line of code, Zror said.
With total control of a router, an attacker can view all of the network’s unencrypted internet traffic. An attacker also can calmly re-route traffic from users on the network to spiteful pages that are designed to steal usernames and passwords.
Zror said that because several of the routers are available from the internet, both make “very good candidates for botnets.”
That’s when an attacker effectively pulls a vulnerable router — or any other internet-connected device — into its own distributed network, controlled by a malicious actor, which can be collectively told to pummel websites and different networks with large amounts of junk traffic, knocking them offline.
There are “thousands” of vulnerable Ruckus routers on the internet, said Zor. He announced his decisions at the annual Chaos Communication Congress conference in Germany.
Ruckus told TechCrunch it made the vulnerabilities in the 200.7.10.202.92 software update but said that customers should update their vulnerable devices themselves.
“By design, our devices do not produce and install software automatically to assure our customers can manage their networks properly,” said Ruckus spokesperson AharonEtengoff. “We are actively advising our customers and associates to expand the latest a firmwarereleases as soon as possible to mitigate these vulnerabilities,” he said.
Ruckus proved its SmartZone-enabled devices and Ruckus Film waypoints are not vulnerable.
“The customers must know that if they’re running an old account [of the software], they might be super vulnerable to here very mild attack,” said Zor.
