Verizon Patches Trio of Vulnerabilities in Home Router

Verizon has patched a trio of vulnerabilities in a router commonly used by millions of customers of the company's Fios bundled Internet access, phone and TV service.

The flaws, in Verizon's Quantum Gateway routers, if exploited, could give attackers complete control over and visibility into all devices connected to it, a researcher from security vendor Tenable reported Tuesday.

The most significant of the three flaws is a command injection flaw (CVE-2019-3914) because it allows an attacker to gain root access to the router, Tenable's security researcher Chris Lyne wrote in a blog Tuesday. An attacker can trigger the vulnerability "by adding a firewall access control role for a network object with a crafted name," he said.

In most cases an attacker would need local network access and be authenticated to the router's administrative Web application interface in order to perform the command injection. An attacker with that kind of access would then be able to configure the router for remote administration so the flaw can be exploited remotely.

The command injection flaw allows an attacker to create back doors on the router, record information and to access other devices on the same network. By exploiting it an attacker could modify security settings on the device and change firewalls rules. They could also take advantage of the flaw to sniff network traffic for banking credentials and passwords to online accounts.

Proof of exploit code for the vulnerability is available. "The exploit can be launched by providing either a plaintext password or a salted password as a command line parameter," Lyne said.

Of the three flaws that Lyne uncovered, one in fact allows an attacker to get the password by using a password sniffer to intercept login requests. That flaw (CVE-2019-3915) results from the fact that HTTPS is not used on the Web administration interface thereby giving attackers a way to replay login requests.

The third flaw (CVE-2019-3916) that Lyne discovered gives attackers a way to retrieve the value of a password salt simply by visiting a URL in a Web browser.

The type of attack enabled by the flaws doesn’t require an advanced skill set. "An attacker with an intermediate level of skill could exploit these flaws," Lyne says in comments to Dark Reading.

Verizon has issued a firmware update patching the three flaws, which are present in routers that the company supplies to new customers of its Fios service. "Users should disable remote administration on their routers and also change the router’s administrator password, so that it is different than the one" that comes with the device, Lyne notes.

Users can verify if they have the latest router firmware from Verizon by logging into the router's web interface and clicking on "System Monitoring." The firmware version that is displayed should be 02.02.00.12, which is the latest version, he says.

Small and home office routers have become ripe targets for criminals because of how easy they are to break into and use for spying on people, stealing data and launching DDoS attacks and spam at others. Adding to the lure is the fact that people have begun connecting a growing number of devices—such as IP cameras, storage devices, DVRs, and thermostats—to these devices in recent years.

Just last week, security researchers reported on a campaign where attackers are changing DNS settings on thousands of home routers so traffic to them is routed through malicious servers. Last year, a threat group believed to be sponsored by a nation-state infected some 500,000 routers and network-attached storage devices with a stealthy, modular malware packaged dubbed VPNFilter.

Many small and home office routers are relatively easy to crack because of inherent security deficiencies and seldom updated or maintained once installed. So vulnerabilities in them can persist for a long time.

Research that security vendor Avast conducted last year showed that 60% of users globally have never once updated the firmware on their routers, leaving them potentially exposed to basic attacks. In addition to using compromised routers to launch DDoS attacks, criminals are increasingly using them for cryptomining and spam forwarding as well, the Avast research showed.

"The router is the central hub of all Internet activity and a prime target for cybercriminals," Lyne says. In this particular instance, the vulnerabilities impacted home routers. "But we’re increasingly seeing targeted attacks against both consumer and business routers because they are rarely, if ever, updated," he notes.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.