Μια κρίσιμη ευπάθεια, που φέρεται να είναι ανοικτή εδώ και πάνω από 10 χρόνια, βρίσκεται σε φάση ενεργής εκμετάλλευσης, επηρεάζοντας εκατομμύρια routers παγκοσμίως.
Η ευπάθεια με CVE-2021-20090, στο web interface των συσκευών με Arcadyan firmware, επιτρέπει την απομακρυσμένη παράκαμψη της πιστοποιημένης πρόσβασης σε αυτές.
Vulnerable devices include dozens of router models from multiple vendors and ISPs, including Asus, British Telecom, Deutsche Telekom, Orange, O2 (Telefonica), Verizon, Vodafone, Telstra, and Telus.
Based on the number of router models and the long list of vendors impacted by this bug, the total number of devices exposed to attacks likely reaches millions of routers.
The security flaw was discovered by Tenable, which published a security advisory on April 26 and added proof of concept exploit code on Tuesday, August 3.
"This vulnerability in Arcadyan’s firmware has existed for at least 10 years and has therefore found its way through the supply chain into at least 20 models across 17 different vendors, and that is touched on in a whitepaper Tenable has released," explained Evan Grant, Tenable Staff Research Engineer, on Tuesday.
Based on the number of router models and the long list of vendors impacted by this bug, the total number of devices exposed to attacks likely reaches millions of routers.
The security flaw was discovered by Tenable, which published a security advisory on April 26 and added proof of concept exploit code on Tuesday, August 3.
"This vulnerability in Arcadyan’s firmware has existed for at least 10 years and has therefore found its way through the supply chain into at least 20 models across 17 different vendors, and that is touched on in a whitepaper Tenable has released," explained Evan Grant, Tenable Staff Research Engineer, on Tuesday.
Αναλυτικά : Bleeping Computer, adslgr
0 Post a Comment:
إرسال تعليق