Wireless Router Root Access Vulnerability Finally Exposed With All Models Named

In 2013, security research firm DefenseCode revealed a major issue that plagued a large number of wireless routers, and because the number of affected devices was in the millions, the company held off on revealing the specifics. Fast-forward four years to the present day, and those details have finally been revealed.

The vulnerability was originally found in a Cisco Linksys router, but it was quickly discovered that the same issue could be found on others - not just other Cisco models, but other vendor models as well. That led the researcher to discover that the issue ultimately related to the Broadcom chipset inside, and in particular, with its uPnP implementation.

D-Link's DSL-2740U is one affected router

uPnP, or "universal plug-and-play", is meant to make life easier when new devices need to connect to the network. Years ago, we might have had just one or two devices to connect to a router. These days, however, that number can reach into the double digits in some households, so the easier the overall setup, the better.

In the case of these affected routers, the uPnP implementation is flawed, and allows an attacker to access important system files that shouldn't be accessed, ultimately allowing them to gain root access to the router. From there, crafty attackers could gain access to the network the router is connected to.

The upside with this issue is that it was first discovered four years ago, so many of the affected routers likely have a patch available. However, not all routers update by themselves (which would be an excellent feature in this case), meaning that a lot of people out there are likely running one of these unpatched, extremely vulnerable routers. If you don't have one of the affected models, your less techy friends and family may - so it'd be worth throwing them a bone and making sure that their network doesn't have a gaping hole.