Linksys routers vulnerable through CGI scripts

Linksys' EA6100-6300 wireless routers need a patch: KoreLogic has published an advisory saying that rubbish CGI scripts in the admin interface open the device up to remote attackers. Since it's a consumer product, it's a fair bet that most of the devices out there won't get patched, but here's the detail. Many of the CGI …

[gollux]

Hey, great news! Cisco/Linksys is so darn cool! Thank you for providing such quality equipment!

Oh, damn. Forgot the Sarcasm tags. And it isn't just their customer grade crap that's vulnerable either. They've been making great strides on their commercial equipment as well. Darn it... Need more sarcasm tags.

[Sandtitz]

Linksys and Cisco parted ways 2 years ago. Linksys in now owned by Belkin so you should expect a rapid response from them to address this vuln.

I'm also waiting for W3C to come up with a sarcasm tag.

[BlartVersenwaldIII]

> I'm also waiting for W3C to come up with a sarcasm tag.

Doesn't the existence of the word "belkin" in your post already preclude than the eyes of any IT professional reading it will already be rolling back in their head fast enough to break their neck?

[ozobken]

Except, of course, that Cisco haven't owned Linksys for a couple of years now

[Ole Juul]

Remote access?

Since this is a low end consumer router, I really don't see the problem. What user of this device really needs remoter access anyway? Just turn it off ffs.

To my way of thinking the real, and major, problem here is that the market is accepting second rate router firmware as standard and acceptable. It may be the former, but it certainly isn't the latter. Consumers deserve better.

[Phil O'Sophical]

Re: Remote access?

Just turn it off ffs.

Isn't it usually off by default anyway? Who would ever turn it on?

[Ole Juul]

Re: Remote access?

Isn't it usually off by default anyway? Who would ever turn it on?

You're probably right. So, to fix this vulnerability the instructions would then be to do nothing.

[AndrueC]

Re: Remote access?

I'd see the real problem being attack from the LAN side using wifi as the entry vector. How many home routers have secure wifi these days?

[Roland6]

Re: Remote access?

>How many home routers have secure wifi these days?

Well for several years now, major UK ISP's have been supplying domestic routers with WPA2/PSK security turned on by default and these routers generally work straight out-of-the-box, only needing to be plugged in.

[Anonymous Coward]

Re: Remote access?

According to my 'ahem' unofficial survey, most of them

[CaNsA]

Prime example...

...of why it's a good thing to be able to use a firmware of your own choosing.

[Whitter]

A great example of "the security debate"

The consumer public don't much care about security: they assume "that just happens" and buy the cheapest.

The same ideology seems to be working at CEO level re. their IT security.

Every example of the fallacy of this thinking is seemingly followed by "somebody else's problem" or "an unlucky hit - won't happen again" and is discounted.

Market forces won't help here: they require "knowledge on both sides" and it is clear the (dominant) buyers are thick as a brick.

So now what?

[Anonymous Coward]

DD-WRT or OpenWRT

The hardware is fine. Just replace the firmware...

[Doctor Syntax]

It really doesn't matter what make or whatever level it's been patched to: no remote admin.

[unitron]

At least this time...

...they told us which model number to worry about, unlike the 600,000 cable modems story

[AustinTX]

EA6300 makes a decent switch

I have this little POS, and while all of it's ports are gigabit, the web interface is agony. It's in the form of a windows 10-like gui of tiles, configurable widgets and many many sub-compartmentalized panels. Some of the config items are very poorly placed, being more suited to a different area. IIRC, DD-WRT runs on it, but was not stable in my experience. Fortunately, you can set it to appear as a dumb switch, and all I use it for is an extension at the far end of the house.

[Kevin McMurtrie]

Most of the Linksys garbage needs a patch

Except Linksys doesn't do patches, maintenance, security, testing, etc.

[Mr Rizla]

same as 6900

I have stopped using my AC6900 as its not possible to block a admin login from the internet, confirmed with Linksys support yesterday, using a Belkin product instead