A security researcher has found several vulnerabilities during a number of Ruckus Wireless routers, which the networking giant has since patched.
Gal Zror told TechCrunch that the vulnerabilities he found lie inside within the web interface software that runs on the company’s Unleashed line of routers.
The flaws are often exploited without having a router’s password, and may be wont to take complete control of affected routers from over the web.
Routers act as a gateway between a home or office network and therefore the wider internet. Routers also are a serious line of defense against unauthorized access thereto network. But routers are often one point of failure. If attackers find and cash in of vulnerabilities within the router’s software, they will control the device and gain access to the broader internal network, exposing computers and other devices to hacks and data theft.
Zror said his three vulnerabilities are often wont to to realize “root” privileges on the router — the very best level of access — allowing the attacker unfettered access to the device and therefore the network.
Although the three vulnerabilities vary by difficulty to take advantage of, the simplest of the vulnerabilities uses just one line of code, Zror said.
With complete control of a router, an attacker can see all of the network’s unencrypted internet traffic. An attacker also can silently re-route traffic from users on the network to malicious pages that are designed to steal usernames and passwords.
Zror said that because many of the router are accessible from the web, they create “very good candidates for botnets” That’s when an attacker forcibly enlists a vulnerable router — or the other internet-connected device — into its own distributed network, controlled by a malicious actor, which may be collectively told to pummel websites and other networks with massive amounts of junk traffic, knocking them offline.
There are “thousands” of vulnerable Ruckus routers on the web, said Zror. He revealed his findings at the annual Chaos Communication Congress conference in Germany.
Ruckus told TechCrunch it fixed the vulnerabilities within the 22.214.171.124.92 software update, but said that customers need to update their vulnerable devices themselves.
“By design our devices don’t fetch and install software automatically to make sure our customers can manage their networks appropriately,” said Ruckus spokesperson Aharon Etengoff. “We are strongly advising our customers and partners to deploy the newest firmware releases as soon as possible to mitigate these vulnerabilities,” he said.
Ruckus confirmed its SmartZone-enabled devices and Ruckus Cloud access points aren’t vulnerable.
“It’s vital for the purchasers to understand that if they’re running an old version [of the software], they could be super susceptible to this very simple attack,” said Zror.