Dangerous 'Misfortune Cookie' flaw discovered in 12 million home routers

Researchers at Check Point have discovered a serious security vulnerability affecting at least 12 million leading-brand home and SME routers that appears to have gone unnoticed for over a decade.

Dubbed the Misfortune Cookie flaw, the firm plans to give a detailed account of the issue at a forthcoming security conference but in the meantime its important to stress that no real-world attacks using it have yet been detected.

That said, an attacker exploiting the flaw would be able to monitor all data travelling through a gateway such as files, emails and logins and have the power to infect connected devices with malware. Man-in-the-middle attacks would also be possible, according to Check Point.

The precise source of the issue is not known - a chipset software development kit (SDK) is suspected - but Check Point warned that up to 200 unpatched models using the RomPager embedded web server software (which uses a remote service called TR-069) prior to version 4.34 were probably vulnerable.

As to which products are affected, this is where it gets a little complicated. Check Point estimates that at least 12 million devices are affected across the world but suggested this could be an underestimate.

Given the popularity of RomPager and the list of affected brands - D-Link, Edimax, Huawei, TP-Link, ZTE, and ZyXEL sold mainly to home users - such pessimism is realistic.

D-Link's DSL-2600U router is one of many affected models.

The issue dates back to 2002 but should have been fixed by an update three years later. However, as Check Point notes:

The patch propagation cycle, however, is incredibly slow (sometimes non-existent) with these types of devices. We can confirm many devices today still ship with the vulnerable version in place, said its research note.

The vulnerability had been designated CVE-2014-9222, but Check Point said that identifying affected devices might not be easy for many users. Some vendors had patched the issue but that fact might not have changed the version number in RomPager software to one later than 4.34.

Link:
Dangerous 'Misfortune Cookie' flaw discovered in 12 million home routers