Friday, May 24, 2024

More than 25,000 Linksys Smart Wi-Fi Routers Leaking Sensitive Information to the Public Internet

A vulnerability with Linksys Smart Wi-Fi routers allows attackers to gain unauthenticated, remote access to the vulnerable router and to access sensitive information.

The vulnerability can be exploited by just knowing the public IP address of the router. It can be exploited simply by just opening the router public IP address in the web browser and from the developer console, move to network and JNAP queries.

By just opening the JNAP queries, the sensitive information will get exposed, and it can be reproduced by sending a request to JNAP endpoint.

“This sensitive information disclosure vulnerability requires no authentication and can be exploited by a remote attacker with little technical knowledge,” reads BadPackets report.

Following are the sensitive information leak that includes

  • MAC address of every device, including historical one
  • Device name
  • Operating System

In some cases, it includes device type, manufacturer, model number, and description. Other sensitive information such as settings, firewall status, firmware update settings, and DDNS settings are also leaked.

“According to researchers 25,617, Linksys Smart Wi-Fi routers are currently leaking sensitive information to the public internet.”

The leakage pose privacy concerns, by having the extracted details attackers gain access to the home or business networks to launch targeted attacks. Following are the devices affected.

756,565 MAC address was leaked Mursch said, most of the Linksys Smart Wi-Fi routers have not changed the default password, which allows an unauthenticated attacker to gain access to the router. The can also be done by merely querying the following JNAP endpoint.

“Our scans have found thousands of routers are still using the default password and are vulnerable to immediate takeover – if they aren’t already compromised,” Mursch added.

Bad Packet reproduced the issue that fixed before five years, “While CVE-2014-8244 was supposedly patched for this issue, our findings have indicated otherwise,” Mursch said.

Linksys security team determined the issue was “Not applicable /Won’t fix” and subsequently closed.

Related Read

Verizon Fios Router Vulnerabilities Allows Attackers to Gain Complete Control Over the Network

New DNS Hijacking Attack Exploiting DLink Routers to Target Netflix, PayPal, Uber, Gmail Users


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles