Algerie Telecom provides TP-LINK TD-W8951ND Router to most of their home customers who Opt-In for Internet services and each of which has ZYXEL embedded firmware installed in it.
ABDELLI Nassereddine, penetration tester and Algerian Computer Science Student has reported highly critical unauthorized access and password disclosure vulnerabilities in the Routers provided by Algerie Telecom.
He told 'The Hacker News' that the vulnerabilities can be exploited by any remote hacker just by exploiting a very simple loophole in the firmware.
First, he found that an unauthorized access is available to 'Firmware/Romfile Upgrade' Section on the Router's panel that can be accessed without any login password i.e. https://IP//rpFWUpload.htmlThis page actually allows a user to upgrade the Firmware of the router and also allows to download the Romfile Backup file (rom-0) i.e. https://IP address/rom-0 (as shown)
This Romfile contains the administrative password of the Router and can be retrieved in plain text by reverse engineering it using a free online service: https://50.57.229.26/zynos.php. One just need to upload the Romfile and can get plain text output easily. Router's password will be displaced in the very first line of the output, as shown below:
He claimed that he has tested the IP address range that belongs to Algeria i.e. 41.107. x. x and found thousands of them are vulnerable to hackers.
A Quick search on SHODAN Search Engine using keyword 'RomPager country:dz' showing more than 2,59,744 devices available on the Internet and 95% of them are now at risk.
ABDELLI also submitted an automated exploit POC script on GITHUB, that can scan the complete subnet for vulnerable routers and will display respective passwords on the screen, as shown:
A Quick search on SHODAN Search Engine using keyword 'RomPager country:dz' showing more than 2,59,744 devices available on the Internet and 95% of them are now at risk.
ABDELLI also submitted an automated exploit POC script on GITHUB, that can scan the complete subnet for vulnerable routers and will display respective passwords on the screen, as shown:
I have tested the flaw over 100's of routers, and found this as a very critical bug. Simply by changing the DNS servers from the victim's router, one can redirect the users' traffic to any malicious server. Such attacks allow hackers to inject the malicious DNS server to perform advance phishing attacks against Facebook, Gmail, Bank Accounts and also whole system can also be compromised.
There is no patch yet available from the vendor, so to prevent yourself from such vulnerability you can forward port 80 to any other website or unused IP address of your network.
There is no patch yet available from the vendor, so to prevent yourself from such vulnerability you can forward port 80 to any other website or unused IP address of your network.
