Security experts at Nightwatch Cybersecurity serious flaws in the Asus RT wireless routers. Dozens of models don’t implement an adequate protection against cross-site request forgery attacks.
The vulnerability, tracked as CVE-2017-5891, affects the Asus RT wireless RT-AC and RT-N models running firmware older than version 220.127.116.11.380.7378.
Poorly configured devices left with default credentials could be easily accessed by an attacker that can take the control of the devices.
According to the experts at Nightwatch Cybersecurity, which discovered the security vulnerability, CSRF on the login page could be exploited by attackers to submit a login request to the router without the user’s knowledge
“The login page for the router doesn’t have any kind of CSRF protection, thus allowing a malicious website to submit a login request to the router without the user’s knowledge. Obviously, this only works if the site either knows the username and password of the router OR the user hasn’t changed the default credentials (“admin / admin”). To exploit, submit the base-64 encoded username and password as “login_authorization” form post, to the “/login.cgi” URL of the browser.” reads the blog post published by Nightwatch Cybersecurity.
Below an example of the form that be exploited by an attacker to trigger the issue:
Once the attacker has accessed the admin interface of the router he can change the settings, and hijack the DNS, and perform other malicious activity.
Experts at Nightwatch also discovered two JSONP vulnerabilities that can expose sensitive information, including network map and details about the router.
Below the other bugs fixed with this last firmware release:
Don’t wast time, update your Router.
(Security Affairs – Asus RT wireless routers, hacking)