Millions of Routers are Actively Exploited Through Bypasses Authentication Bug

The security researcher at the information security company Tenable Evan Grant detected that a serious security violation puts millions of routers at risk all over the world.

According to the report of a security analyst, this is a critical vulnerability that circumvents the authentication and attacks the home devices that are using Arcadyan firmware. 

However, this attack generally enables the threat actors to control them and to implement the attacks utilizing the Mirai botnet.

Millions of Routers Are Vulnerable

After investigating the attack, the security analysts came to know that this vulnerability has attacked millions of routers models from different merchants and ISPs, that also includes:- 

• Asus
• British Telecom
• Deutsche Telekom
• Orange
• O2 (Telefonica)
• Verizon
• Vodafone
• Telstra
• Telus

The security vulnerability has been detected by the Tenable, which is tracked as “CVE-2021-20090” with a CVSS score of 9.9 and after detecting the attack they published about it on April 26, not only this, recently, the experts have also provided some proof of concept exploit code.

However, the cybersecurity experts have studied the matter clearly, and based on the number of routers as well as the merchants that are infected by this vulnerability attack are increasing rapidly and went to millions, that’s why the experts are trying their best to detect all the infected devices.

Attack Details

After investigating the security experts came to know that the attack was started from the IP address 27.22.80[.]19 over HTTP. Moreover, the attackers have modified the configuration of all the attacked devices, and it allows the Telnet to utilize “ARC_SYS_TelnetdEnable=1”.

Once it does, after that it moves to download a new script from the IP address 212.192.241[.]72 utilizing either wget or curl and then administers the whole operation that they have planned.

List of all known affected devices and vendors

The security experts have mentioned the full list of the affected devices and vendors, and here below we have mentioned an image in which the full list is mentioned:-

Attacks start two days later the PoC exploit release

The most interesting point is that the security lab Juniper Threat has detected some attack patterns that are trying to exploit this vulnerability and after investigating it the analysts came to know that it was coming from IP addresses that are initially located in Wuhan, Hubei province, China.

However, in this attack, the cybercriminals are using some malicious tools so that they can deploy a Mirai botnet variant, and it is quite similar to those which were used in a Mirai campaign that is targeting IoT and network security devices.

In both the attacks, there are some similarities, and the researchers stated that after studying the similarities it indicates that the threat actors that are behind these attacks are the same.

However, to know the exact details of these attacks, the security analysts are investigating the whole matter, and they have claimed that they will soon disclose the details of this attack.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.