4 ms·

Freshly disclosed vulnerability CVE-2021-20090 exploited in the wild

58 points by afrcnc 5y ago

GrayShade 5y ago
There's another post on the front page that's somewhat relevant to this: https://news.ycombinator.com/item?id=28105100 https://news.ycombinator.com/item?id=28105100. I've seen dozens of command injection bugs in router firmware, it's terrible how we never learn.
crypt1d 5y ago
From the article: > As of August 5, we have identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in _Wuhan, Hubei province, China_. It would be some next-level cyber trolling if the attacks were deploying some kind of a virus.
- bierjunge 5y ago
  COVID-20 or COVID-19-rev-B would be great names for that.
fouc 5y ago
> As of August 5, we have identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in Wuhan, Hubei province, China Oh the irony
- px43 5y ago
  Eh, Wuhan has over 11 million people in it. It's much bigger than any US city, and almost all US states. A lot of stuff is going to come from there, especially shady network traffic. The city has also been there for 3.5 thousand years, so a lot has come from there historically as well. I think this is one of those things where you hear about a type of car or something, then you start seeing it everywhere. They've always been there, but just never triggered those recognition circuits until they were primed to.
  - fouc 5y ago
    Good point
1over137 5y ago
The article mentions the IP "27.22.80[.]19". What does the [] mean?
- GrayShade 5y ago
  Nothing, it's to avoid having the offending IP in plain text in the web page.
whoknowswhat11 5y ago
I wish the headlines would be a bit more specific - ie, wireless router authentication bypass. The other key piece, is this bypass available from the internet generally or just from LAN side. That's a key difference, and not clear - I've found when they say remote unauthenticated attacker often these vulns are NOT available WAN side. So you often end up with a better headline of wireless router vulnerable to LAN side authentication bypass. I haven't looked at this one. But CVE as a headline is not that useful -> get past overbroad statements -> you might get to a more useful one sentance headline (these articles sometimes require reading 300+ words to even get a sense of what risk actually is - it's the new style).
- stargravy 5y ago
  It depends on the model/Vendor. There were upwards of ~15k devices showing their web interface WAN side and it could be that it is enabled by default in some cases. You're right that the risk is dropped significantly if the web ui isn't showing WAN side (though could still be an issue for businesses using the router for public wifi, or in shared residences, etc).

58 points by afrcnc 5y ago

There's another post on the front page that's somewhat relevant to this: https://news.ycombinator.com/item?id=28105100 https://news.ycombinator.com/item?id=28105100. I've seen dozens of command injection bugs in router firmware, it's terrible how we never learn.

crypt1d 5y ago

From the article: > As of August 5, we have identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in _Wuhan, Hubei province, China_. It would be some next-level cyber trolling if the attacks were deploying some kind of a virus.

bierjunge 5y ago
COVID-20 or COVID-19-rev-B would be great names for that.

fouc 5y ago

> As of August 5, we have identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in Wuhan, Hubei province, China Oh the irony

px43 5y ago
Eh, Wuhan has over 11 million people in it. It's much bigger than any US city, and almost all US states. A lot of stuff is going to come from there, especially shady network traffic. The city has also been there for 3.5 thousand years, so a lot has come from there historically as well. I think this is one of those things where you hear about a type of car or something, then you start seeing it everywhere. They've always been there, but just never triggered those recognition circuits until they were primed to.
- fouc 5y ago
  Good point

1over137 5y ago

The article mentions the IP "27.22.80[.]19". What does the [] mean?

GrayShade 5y ago
Nothing, it's to avoid having the offending IP in plain text in the web page.

whoknowswhat11 5y ago

I wish the headlines would be a bit more specific - ie, wireless router authentication bypass. The other key piece, is this bypass available from the internet generally or just from LAN side. That's a key difference, and not clear - I've found when they say remote unauthenticated attacker often these vulns are NOT available WAN side. So you often end up with a better headline of wireless router vulnerable to LAN side authentication bypass. I haven't looked at this one. But CVE as a headline is not that useful -> get past overbroad statements -> you might get to a more useful one sentance headline (these articles sometimes require reading 300+ words to even get a sense of what risk actually is - it's the new style).

stargravy 5y ago
It depends on the model/Vendor. There were upwards of ~15k devices showing their web interface WAN side and it could be that it is enabled by default in some cases. You're right that the risk is dropped significantly if the web ui isn't showing WAN side (though could still be an issue for businesses using the router for public wifi, or in shared residences, etc).