Guru3D.com
  • HOME
  • NEWS
    • Channels
    • Archive
  • DOWNLOADS
    • New Downloads
    • Categories
    • Archive
  • GAME REVIEWS
  • ARTICLES
    • Rig of the Month
    • Join ROTM
    • PC Buyers Guide
    • Guru3D VGA Charts
    • Editorials
    • Dated content
  • HARDWARE REVIEWS
    • Videocards
    • Processors
    • Audio
    • Motherboards
    • Memory and Flash
    • SSD Storage
    • Chassis
    • Media Players
    • Power Supply
    • Laptop and Mobile
    • Smartphone
    • Networking
    • Keyboard Mouse
    • Cooling
    • Search articles
    • Knowledgebase
    • More Categories
  • FORUMS
  • NEWSLETTER
  • CONTACT

New Reviews
Intel NUC 13 Pro (Arena Canyon) review
Endorfy Arx 700 Air chassis review
Beelink SER5 Pro (Ryzen 7 5800H) mini PC review
Crucial T700 PCIe 5.0 NVMe SSD Review - 12GB/s
Sapphire Radeon RX 7600 PULSE review
Gainward GeForce RTX 4060 Ti GHOST review
Radeon RX 7600 review
ASUS GeForce RTX 4060 Ti TUF Gaming review
MSI GeForce RTX 4060 Ti Gaming X TRIO review
GeForce RTX 4060 Ti 8GB (FE) review

New Downloads
AMD Radeon Software Adrenalin 23.5.2 WHQL download
Intel ARC graphics Driver Download Version: 31.0.101.4382
CrystalDiskInfo 9.0.1 Download
Corsair Utility Engine Download (iCUE) Download v5.2
GeForce 535.98 WHQL driver download
CPU-Z download v2.06
AMD Radeon Software Adrenalin 23.5.1 WHQL download
GeForce 532.03 WHQL driver download
AMD Chipset Drivers Download 5.05.16.529
Display Driver Uninstaller Download version 18.0.6.4


New Forum Topics
Review: Beelink SER5 Pro (Ryzen 7 5800H) mini PC AMD Software: Adrenalin Edition 23.5.2 - Driver Download and Discussion Reference AMD RX 7600 to undergo modifications to ensure compatibility with all power cables German translation NVIDIA GeForce Game Ready 535.98 WHQL Download & Discussion Aliexpress "3070M" Desktop card driver NVIDIA GeForce Hotfix Driver 536.09 3060ti vs 6700xt a year later finally joined the 5800X3D club Amernime Zone AMD Software: Adrenalin / Pro Driver - Discovery Remix 23.4.2 WHQL [Omega 23.5.1 WIP]




Guru3D.com » News » Millions Of Routers Vulnerable To Attacks Due To NetUSB Bug

Millions Of Routers Vulnerable To Attacks Due To NetUSB Bug

by Hilbert Hagedoorn on: 05/25/2015 08:46 AM | source: | 12 comment(s)
Millions Of Routers Vulnerable To Attacks Due To NetUSB Bug

A serious vulnerability affecting the NetUSB kernel driver developed by Taiwan-based tech company KCodes exposes millions of routers to hack attacks, researchers have warned. According to its website, KCodes is one of the leading developers and suppliers of USB over IP solutions. The company says over 20% of world's networking devices include KCodes technology.

According to its website, KCodes is one of the leading developers and suppliers of USB over IP solutions. The company says over 20% of world’s networking devices include KCodes technology.

The NetUSB (USB over IP) kernel driver developed by the company is designed to allow users to connect over their network to USB devices plugged into a router, access point, or other Linux-based embedded system. Users can access speakers, printers, hard drives, webcams and other USB devices by connecting to a NetUSB server via the Windows or OS X client.

Researchers at SEC Consult discovered that the NetUSB driver is plagued by a kernel stack buffer overflow vulnerability (CVE-2015-3036) that can be exploited by an unauthenticated attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. The flaw, caused by insufficient input validation, can be triggered by specifying a computer name that is longer than 64 characters when the client connects to the server.

KCodes’ NetUSB driver is integrated into products from several vendors, including Netgear, TP-Link, ZyXEL, and TRENDnet. The feature is advertised with various names, such as “print sharing,” “USB share port” and “ReadySHARE.”

SEC Consult has confirmed that the vulnerability affects the latest firmware versions for TP-Link TL-WDR4300 V1, TP-Link WR1043ND v2, and Netgear WNDR4500. Researchers also identified the NetUSB feature in tens of router models from D-Link, Netgear, TP-Link, TRENDnet, and ZyXEL.

Furthermore, a component of the driver makes references to a total of 26 vendors that have likely licensed the NetUSB technology. The list includes Allnet, Ambir Technology, AMIT, Asante, Atlantis, Corega, Digitus, EDIMAX, Encore Electronics, Engenius, Etop, Hardlink, Hawking, IOGEAR, LevelOne, Longshine, PCI, PROLiNK, Sitecom, Taifa, and Western Digital.

The vulnerability can be exploited by an attacker on the local network, but in some cases exploitation over the Internet might also be possible through TCP port 20005, the port used by the server for client connections.

“While NetUSB was not accessible from the internet on the devices we own, there is some indication that a few devices expose TCP port 20005 to the internet. We don’t know if this is due to user misconfiguration or the default setting within a specific device. Exposing NetUSB to the internet enables attackers to get access to USB devices of potential victims and this would actually count as another vulnerability,” SEC Consult wrote in a blog post.

SEC Consult informed KCodes of the existence of the vulnerability in February, but so far the vendor has failed to properly communicate the status of a patch.

The security firm told that it hasn’t heard from KCodes since March 25, but it has learned that Netgear and TP-Link received patches for their firmware from the developer. Vendors can’t address the bug without the patch from KCodes, SEC Consult noted.

“To this day, only TP-LINK released fixes for the vulnerability and provided a release schedule for about 40 products. Sometimes NetUSB can be disabled via the web interface, but at least on NETGEAR devices this does not mitigate the vulnerability. NETGEAR told us, that there is no workaround available, the TCP port can't be firewalled nor is there a way to disable the service on their devices,” SEC Consult said.



Millions Of Routers Vulnerable To Attacks Due To NetUSB Bug




« First GeForce GTX 980 Ti Pictures hit the web · Millions Of Routers Vulnerable To Attacks Due To NetUSB Bug · Thermaltake Suppressor F51 Mid-tower Chassis »

Related Stories

Millions of infected machines might go offline March 8 - - 02/18/2012 02:02 PM
In three weeks, the FBI could knock millions of infected systems offline by disabling some DNS servers as techspot reported. In November, Estonian authorities arrested six men suspected of using &quot...

Millions Copies of Dirt 3 keys leaked onto web - 09/07/2011 07:42 AM
Publishers Codemasters and graphics card manufacturer AMD have been running a promotion lately whereby purchasers of a card got a free copy of excellent racer Dirt 3. That offer has now been, uh, slig...

Samsung invest millions into Fusion-io SSD specialists - 10/22/2009 09:56 AM
Samsung have invested

Millions infected by new Windows Worm - 01/19/2009 11:53 AM
The malicious program, known as Conficker, Downadup, or Kido was first discovered in October 2008. Although Microsoft released a patch, it has gone on to infect 3.5m machines. Experts warn this figure...


3 pages 1 2 3


tsunami231
Senior Member



Posts: 13878
Joined: 2003-05-24

#5080313 Posted on: 05/25/2015 09:12 PM
asus escaped this eh?

PhazeDelta1
Senior Member



Posts: 15616
Joined: 2010-09-12

#5080417 Posted on: 05/26/2015 12:22 AM
Here is the list with some more info.

Sadly enough my Netgear R7000 is in there aswell.



Both of my Netgear Routers are on that list.

Clouseau
Senior Member



Posts: 2811
Joined: 2011-05-17

#5080491 Posted on: 05/26/2015 02:22 AM
My Netgear router is as well. Is it incorrect to think that since I have Readyshare disabled the router is not affected? Or it does not matter whether it is enabled or not?

Daftshadow
Senior Member



Posts: 1331
Joined: 2004-07-10

#5080557 Posted on: 05/26/2015 04:32 AM
good thing i replaced my previous router which was a tp-link which is on the list to a linksys which isn't on the list :)

fantaskarsef
Senior Member



Posts: 14625
Joined: 2014-07-21

#5080600 Posted on: 05/26/2015 07:36 AM
Better check for new firmware on my TP link router I guess... but as it's been doing strange things recently, and my new mainboard having faster WLAN than the router could provide internally, I might as well think about getting a new router anyway.

3 pages 1 2 3


Post New Comment
Click here to post a comment for this news story on the message forum.


Guru3D.com © 2023