13 router and NAS brands vulnerable to attack

Security researchers discovered that SOHO routers and NAS devices from 13 brands, including Buffalo, Synology, ASUS, Netgear, TerraMaster, Drobo, Zyxel, TOTOLINK, Asustor, Seagate, QNAP, Mi, and Lenovo, are affected by remotely exploitable bugs. In total, the researchers found 125 different CVEs.

“All 13 of the devices we evaluated had at least one web application vulnerability such as cross-site scripting (XSS), operating system command injection (OS CMDi), or SQL injection (SQLi) that could be leveraged by an attacker to get remote access to the device’s shell or gain access to the device’s administrative panel,” the researchers said in a paper released on Monday. “We obtained root shells on 12 of the devices, allowing complete control over the device, including six which can be remotely exploited without authentication: The Asustor AS-602T, Buffalo TeraStation TS5600D1206, TerraMaster F2-420, Drobo 5N2, Netgear Nighthawk R9000, and TOTOLINK A3002RU.”

The researchers got in touch with all manufacturers but just nine of them were responsive and took mitigation steps. Full details at Threatpost.