There are multiple vulnerabilities in a Belkin router that could leave it open to an attack, according to the CERT/CC Division of the Software Engineering Institute at Carnegie Mellon University in the US.
Joel Land, a vulnerability analyst at CERT, reported that Belkin’s N600 DB Wireless Dual Band N+ router - model F9K1102 v2 - contains five specific flaws that make it extremely exploitable.
He said: “A remote, unauthenticated attacker may be able to spoof DNS responses to cause vulnerable devices to contact attacker-controlled hosts or induce an authenticated user into making an unintentional request to the web server that will be treated as an authentic request.”
Additionally, the expert continued, a local area network (LAN) based attacker would be able to completely circumvent the need for authentication and “take complete control of vulnerable devices”.
Problematically, Mr Land highlighted, there isn’t a “practical solution” to these identified vulnerabilities at present.
However, there are some temporary solutions for anyone that relies on this specific model. Namely, they should consider “workarounds” suggested by CERT/CC.
These include employing strong passwords for Wi-Fi - as well as the web management interface - and only allowing trusted hosts to be able to connect to the LAN.
However, Mr Land added: “There are no practical workarounds for the DNS spoofing or firmware over HTTP issues, as general users are unlikely to be able to monitor traffic entering the router's WAN port.”
Wi-Fi routers have been under a lot of scrutiny as of late with regards to internet security, with numerous demonstrations revealing multiple flaws that make them easy to attack.
