- Apr 25, 2013
- 5,355
A buffer overflow security flaw in the N750 router from Belkin that was launched back in 2011 has been fixed by the company, eliminating the risk of a remote unauthenticated attacker executing commands with high administrative privileges.
The vulnerability has been discovered by Marco Vaz from consulting and advisory firm Integrity in Portugal.
He developed a module for Metasploit penetration testing tool that would exploit the security glitch, offering a malicious guest user admin access to the affected router. The exploit would allow access to the telnet server from the guest network to the root shell.
The vulnerability received the CVE-2014-1635 identifier and presents a serious risk to users who do not apply the patch, receiving the highest severity score by the CVSS (Common Vulnerability Scoring System) v2 standards.
If exploited, an intruder can achieve full control of the device by sending an unauthenticated POST request to the web server in charge of authentication on the guest network.
The affected firmware version vulnerable to this attack is n750 F9K1103_WW_1.10.16m, and Belkin has released an update (n750 F9K1103_WW_1.10.17m) that mitigates the issue.
Vaz reported the flaw to the vendor on January 24, 2014, and four days later he sent a proof-of-concept to demonstrate the weakness. In March, Belkin issued a patch.
The vulnerability has been discovered by Marco Vaz from consulting and advisory firm Integrity in Portugal.
He developed a module for Metasploit penetration testing tool that would exploit the security glitch, offering a malicious guest user admin access to the affected router. The exploit would allow access to the telnet server from the guest network to the root shell.
The vulnerability received the CVE-2014-1635 identifier and presents a serious risk to users who do not apply the patch, receiving the highest severity score by the CVSS (Common Vulnerability Scoring System) v2 standards.
If exploited, an intruder can achieve full control of the device by sending an unauthenticated POST request to the web server in charge of authentication on the guest network.
The affected firmware version vulnerable to this attack is n750 F9K1103_WW_1.10.16m, and Belkin has released an update (n750 F9K1103_WW_1.10.17m) that mitigates the issue.
Vaz reported the flaw to the vendor on January 24, 2014, and four days later he sent a proof-of-concept to demonstrate the weakness. In March, Belkin issued a patch.
