Nine WiFi routers used by millions were vulnerable to 226 flaws

LASER_oneXM

Level 37
Thread author
Verified
Top poster
Well-known
Feb 4, 2016
2,520
Security researchers analyzed nine popular WiFi routers and found a total of 226 potential vulnerabilities in them, even when running the latest firmware.
The tested routers are made by Asus, AVM, D-Link, Netgear, Edimax, TP-Link, Synology, and Linksys, and are used by millions of people.

The front-runners in terms of the number of vulnerabilities are the TP-Link Archer AX6000, having 32 flaws, and the Synology RT-2600ac, which has 30 security bugs.
While not all flaws carried the same risk, the team found some common problems that affected most of the tested models:

  • Outdated Linux kernel in the firmware
  • Outdated multimedia and VPN functions
  • Over-reliance on older versions of BusyBox
  • Use of weak default passwords like "admin"
  • Presence of hardcoded credentials in plain text form
Jan Wendenburg, the CEO of IoT Inspector, noted that one of the most important ways of securing a router is to change the default password when you first configure the device.

"Changing passwords on first use and enabling the automatic update function must be standard practice on all IoT devices, whether the device is used at home or in a corporate network." explained Wendenburg.

"The greatest danger, besides vulnerabilities introduced by manufacturers, is using an IoT device according to the motto 'plug, play and forget'."