Popular Belkin Wi-Fi routers plagued by unpatched security flaws

Remote unauthenticated attackers could exploit the vulnerabilities to spoof DNS (Domain Name System) responses and direct users to rogue websites or trick users' browsers to change the device configuration, the CERT Coordination Center (CERT/CC) at Carnegie Mellon University said Monday in an advisory.

Furthermore, attackers with access to the local area network could bypass an affected router's authentication and take complete control over it, CERT/CC said.

Exploiting some of the vulnerabilities requires attackers to be in a man-in-the-middle position between the router and its DNS servers or Belkin's update servers. However, other flaws can be exploited by tricking users on the local network to visit specially crafted Web pages or by infecting their computers with malware.

The Web-based attack technique is known as cross-site request forgery (CSRF) and is an abuse of the way browsers are designed to work. A website has the ability to force a browser to send a request to a third-party website and this can be a router's administrative interface that's only accessible over the local network.

By default, the Belkin N600 doesn't require a password for accessing the management interface, so potential CSRF attacks against such devices might not even require users to be authenticated.

Router manufacturers are often quick to point out that flaws in their devices' Web-based management interfaces cannot be attacked remotely because those interfaces are not exposed to the Internet by default.

However, they rarely mention CSRF, an attack vector that hackers are increasingly using against home routers, including in large-scale campaigns launched through legitimate websites.

CERT/CC confirmed the vulnerabilities in the 2.10.17 firmware of the Belkin N600 DB F9K1102 v2 model, but noted that earlier versions are also possibly affected.

The organization is not aware of any patches available from the vendor and advises users to take general security precautions like setting strong passwords for the router's management interface and Wi-Fi network and only allowing trusted computers on the LAN.

Users behind these routers should never browse the Internet while the Web management interface has an active session in a browser tab, CERT/CC said.

There are no practical workarounds for the DNS spoofing or firmware over HTTP issues and no way to prevent attackers from exploiting the authentication bypass vulnerability once they have access to the local network, the organization warned.