Unpatched Security Flaws in Linksys Routers

(pc-Google Images)

Researchers have disclosed the existence of unpatched security flaws in Linksys routers which are exposing thousands of devices to attack.

IOActive today released information on a number of security vulnerabilities found in more than 20 models of Linksys Smart Wi-Fi Routers.

The vulnerabilities identified, if exploited, could allow attackers to overload a router and force a reboot, deny user access, leak sensitive information about the router and connected devices, and change restricted settings.

"A number of the security flaws we found are associated with authentication, data sanitisation, privilege escalation, and information disclosure," said Sauvage. "Additionally, 11 per cent of the active devices exposed were using default credentials, making them particularly susceptible to an attacker easily authenticating and potentially turning the routers into bots, similar to what happened in last year's Mirai Denial of Service (DoS) attacks."

In addition, attackers that have gained authentication on the devices can execute commands with root privileges and create backdoor accounts for persistent access that are not viewable in the router smart management console.

IOActive informed Linksys of the issues in January, allowing the company three months to address the problems before going public with its findings.