The Unfixed Router
A Broadcom Wi-Fi flaw lets an attacker within radio range run code as root on routers, and no fix has been deployed to them, a researcher says.
Key terms
AP Cybersecurity alignment
- 3.1.B.4Adversaries standing outside of physically secure spaces can pick up the signals and beacon frames from a wireless access point that is broadcasting outside the physical space. This allows them to gather information about the…Learning objective: Explain how adversaries can exploit network vulnerabilities to steal, disrupt, or destroy network communication.
- 4.1.C.1Adversaries can develop exploits for known vulnerabilities in software (including operating systems). Devices with unpatched software are vulnerable to these exploits, which could allow an adversary to crash a system, view…Learning objective: Explain how adversaries can exploit common device vulnerabilities to cause loss, damage, disruption, or destruction.
- 4.3.C.1When vulnerabilities in operating systems and software are found, the vendor or organization that maintains the operating system software will fix it and send an update. A small update is called a patch.Learning objective: Explain why keeping a device’s operating system and software updated makes it more secure.
AP Networking alignment
- 1.4.C.2Encrypting data before transmission makes it more difficult for an adversary to read captured data. Wireless networks should be configured to use the highest level of encryption available in the router or wireless access point…Learning objective: Configure wireless network security features.
- 2.5.A.3Data loss, device compromise, or malware infection can result when network devices are not updated or secured. These impacts may occur due to outdated firmware or the connection of untrusted devices with known vulnerabilities.Learning objective: Identify impacts of potential security vulnerabilities in a SOHO network.
- 4.1.A.3When confidentiality is compromised, systems are vulnerable to having sensitive data exposed or stolen. A breach of confidentiality can be identified by: • unauthorized access • network traffic showing exfiltration of…Learning objective: Identify evidence of compromised confidentiality, integrity, or availability.