Researchers Uncover 125 Vulnerabilities Across 13 Routers and NAS Devices

'Independent Security Evaluators (ISE) discovered a total of 125
different security vulnerabilities across 13 IoT devices, likely
affecting millions of consumers. Help Net Security reports:

In nearly all the devices (12 of the 13), ISE achieved its goal of
obtaining remote root-level access. The table below shows the types of
vulnerabilities that ISE identified in the targets. All 13 of the
devices evaluated by ISE had at least one web application
vulnerability such as cross-site scripting (XSS), operating system
command injection (OS CMDi), or SQL injection (SQLi) that could be
leveraged by an attacker to get remote access to the device's shell or
gain access to the device's administrative panel. ISE obtained root
shells on 12 of the devices, allowing complete control over the
device.

Six of them can be remotely exploited without authentication: the
Asustor AS-602T, Buffalo TeraStation TS5600D1206, TerraMaster F2-420,
Drobo 5N2, Netgear Nighthawk R9000, and TOTOLINK A3002RU. "We found
that many of these issues were trivial to exploit and should have been
discovered even in a rudimentary vulnerability assessment," says ISE
founder Stephen Bono. "This indicates that these manufacturers likely
undergo no such assessment whatsoever, that the bug bounty programs
they employ are ineffective, that vulnerability disclosures sent to
them are not addressed, or more likely, all of the above."'

-- source: https://it.slashdot.org/story/19/09/17/2053202

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list -- [email protected] | To unsubscribe send an email to [email protected]
Unsubscribe: %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s