A security advisory from Synopsys revealed multiple vulnerabilities in the chipsets of wireless routers manufactured by Qualcomm, MediaTek, and Realtek. Referred to as CVE-2019-18989, CVE-2019-18990, and CVE-2019-18991, the partial authentication bypass vulnerabilities could allow an attacker to exploit the authentication process by injecting packets into a WPA2-protected network without a password.
“An attacker can arbitrarily send unencrypted packets and receive encrypted responses. These unencrypted packets are sent from a spoofed MAC address. The vulnerable access point does not drop the plain-text packets and routes them to the network as though they were valid. Response is also received back, but that is encrypted. The only requirement is that there is another properly authenticated client connected to WPA2 network,” Synopsys said.
The Synopsys cybersecurity research center also listed vulnerable chipsets in different wireless routers, which include:
Mediatek:
- Chipset: MT7620N
- Devices tested: D-Link DWR-116 V1.06(EU)
Qualcomm (Atheros):
- Chipset: AR9132
- Devices tested: Zyxel NBG460N V3.60(AMX.8)
- Chipset: AR9283
- Devices tested: Buffalo WHR-G300N V2 V1.85 (R1.18/B1.03)
- Chipset: AR9285
- Devices tested: Netgear WNR1000 V.1.0.0.12NA
Realtek:
- Chipset: RTL8812AR
- Devices tested: D-Link DIR-850L V1.21WW
- Chipset: RTL8196D
- Chipset: RTL8881AN
- Devices tested: D-Link DIR-809 Rev A3 V1.09 Rev A2
- Chipset: RTL8192ER
- Devices tested: D-Link DIR-605L H/W: B2 V2.10
Synopsys stated that it received responses from all the manufacturers after the vulnerability disclosure. While MediaTek and Realtek said the patches will be made available upon request, Qualcomm stated that all the chipsets have reached end-of-life and have been discontinued.
Hackers Exploit Routers for Botnets
Cybersecurity solutions provider Trend Micro warned users about a new wave of attacks targeting home routers. In its research report “Worm War: The Botnet Battle for IoT Territory,” Trend Micro revealed that cybercriminals are using home routers to build botnets. The research found a surge in cyberattacks by exploiting routers, particularly in Q4 2019. Attackers made brute force log-in attempts against routers by using automated software to try common password combinations. The number of attacks increased from around 23 million in September to nearly 249 million attacks in December 2019. In March 2020, around 194 million brute force login attacks were reported.
Also Read: How to Secure Your Router Network
