D-Link and TRENDnet's routers are vulnerable to remote code execution attacks due to a flaw in a component of the Realtek, Software Development Kit (SDK).
A content developer at HP Enterprise Security discovered the flaw.
Ricky Lawshae first informed about the flaw to HP’s Zero-Day Initiative (ZDI) in August 2014. Then in October, he reported for the last time about his findings to them.
However, the Realtek did not come up with a plan to solve the problem. As a result, the routers flaw has been disclosed.
The vulnerability (CVE-2014-8361) allows a remote, unauthenticated attacker to execute arbitrary code on affected systems with root privileges. ZDI has assigned the vulnerability a CVSS score of 10.
The security hole affects the Realtek SDK used for RTL81xx chipsets.
Although, the flaw on D-Link and TRENDnet routers has been discovered, it is not clear that how many small office and home (SOHO) routers are affected.
The researcher however said that those devices using the minigd binary from the Realtek SDK are likely to be vulnerable.
“Given the stated purpose of Realtek SDK, and the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines,” ZDI officials wrote in an advisory published on Friday.
“Only the clients and servers that have a legitimate procedural relationship with products using Realtek SDK service should be permitted to communicate with it.”
“Only the clients and servers that have a legitimate procedural relationship with products using Realtek SDK service should be permitted to communicate with it.”
Realtek still has not commented on the findings.
D-Link has released firmware updates that addresses the security vulnerabilities in affected D-Link devices.
D-Link has released firmware updates that addresses the security vulnerabilities in affected D-Link devices.
It is said that the flaw, which was found on those wireless routers, are not unique or rare.
Earlier, researchers reported about the several vulnerabilities related to the ncc/ncc2 service used by devices from the vendors. Both D-Link and Trendnet released firmware updates to address the issues.
Last month, a researcher complained that D-Link had failed to properly patch those vulnerabilities related to the Home Network Administration Protocol (HNAP).
