Security researcher Marco Vaz discovered a serious vulnerability in the Belkin N750 router that could be exploited to gain access. The company has already released a patch to fix the vulnerability, but the number of users installing the firmware is small.
The flaw, codenamed CVE-2014-1635, affects the Guest Network Web interface of the N750 DB Wi-Fi Dual-Band N+ Gigabit Router model running firmware version F9K1103_WW_1.10.16m. According to Marco Vaz of Integrity Labs, the flaw is simply a buffer overflow. The Belkin has guest networking enabled by default and does not require authentication. To resolve the issue, Belkin is urging users to upgrade their firmware to the latest version F9K1103_WW_1.10.17m. Marco Vaz explains in his article that the vulnerability was discovered after a series of tests. The researcher discovered that the “jump” parameter used in requests is affected by the buffer overflow.
“ Fuzzing, in general, plays an important role in discovering a vulnerability. This is what happened in this case. After a few fuzzed requests I noticed that the position of the “jump” parameter was affected by a classic buffer overflow, with a payload of 5000 bytes. After the overflow the process died. Once he discovered the flaw, Vaz worked on exploiting the vulnerability. To do this he simulated the router process, so that he could repair the MIPS32 process on an x86 computer.
The expert discovered that an unauthenticated attacker could execute root-level commands by sending specially crafted POST requests to httpd (Apache HyperText Transfer Protocol server program). httpd implements authentication on guest network connections.
Mar Vaz also developed a Metasploit module to exploit the vulnerability:
“I have developed a Metasploit module to exploit this vulnerability, which also executes iptables commands, so that it is possible to telnet the server, directly, from the guest network in the root shell.” Integrity Labs reported the vulnerability for Belkin on January 24 and released a newer firmware version on March 31.
