Due to an old bug, millions of routers can be hijacked over Wi-Fi

A WPSplinter vulnerability was rediscovered; the interesting point is that the fix was made almost eight years ago. However, it has practically never reached routers. In addition to this, the lack of a CVE makes the issue invisible for patch pipelines. Such insights were announced by Quentin Kaiser at the Hexacon conference.

Details regarding WPSplinter vulnerability

The bug was detected in Broadcom’s old code for WPS; this feature allows the connection to the device via button pressing. Via this code, certain messages can be processed incorrectly and allow an attacker to run external code or read the router’s memory. The attacker doesn’t need any additional information regarding the PW; this user should only be within the radio range to make a connection. The problems are mainly in Broadcom’s code, but not in WPS.

During the conference demo, on the Askey TCG3000 gateway, the Wi-Fi key was retrieved from the device’s NVRAM, and then it was used for the connection to the network. Then, on the Proximus device, it was possible to create a remote shell. This vulnerability was detected with the help of AI in less than a week.

This vulnerability is available on major Belgian ISPs such as VOO, Proximus, and Orange. According to rough calculations, the approximate count of vulnerable devices reaches 1.5 million only in Belgium. Other affected models are from Nokia, TP-Link, Cisco, ZTE, Zyxel, and some more besides these. If those users are added to an account, the global number can be, on average, hundreds of millions.

Broadcom reacted that they have been aware of the issues since 2018, and this code is already outside of its support window.  

If users have any concerns relating to the ISP’s router firmware, the best recommendation here is to switch off the gateway’s Wi-Fi, then switch to bridge mode, and use their own up-to-date router. Also, you can find a detection script on GitHub.  

Hope you found this article helpful - what do you think? Like and subscribe to our blog to get more practical tips and the latest tech news from HostZealot.