Over 25,000 Linksys routers vulnerable to sensitive information disclosure flaw

Our honeypots frequently detect scans targeting various home automation protocol endpoints. Many of these attacks aim to exploit vulnerable consumer routers. Upon further investigation, we’ve discovered a persistent flaw affecting Linksys Smart Wi-Fi routers that allows unauthenticated remote access to sensitive information.

How can the vulnerability be exploited?

1. 1. Go to the Linksys Smart Wi-Fi router’s public IP address in your web browser
   2. Open the developer console (F12 key) and go to the Network tab
   3. Scroll down to JNAP (there’s multiple) and click to open it

Example vulnerable Linksys Smart Wi-Fi EA7500 (AC1900) router

The leak can also be reproduced by sending a request to this JNAP endpoint:

X-JNAP-ACTION: http://cisco.com/jnap/devicelist/GetDevices

This sensitive information disclosure vulnerability requires no authentication and can exploited by an attacker with little technical knowledge.

How many Linksys Smart Wi-Fi routers are vulnerable?

Using data provided by BinaryEdge , our scans have found 25,617 Linksys Smart Wi-Fi routers are currently leaking sensitive information to the public internet, including:

• • MAC address of every device that’s ever connected to it (full historical record, not just active devices)
  • Device name (such as “TROY-PC” or “Mat’s MacBook Pro”)
  • Operating system (such as “Windows 7” or “Android”)

In some cases additional metadata is logged such as device type, model number, and description – as seen in the example below.

Other sensitive information about the router such as the WAN settings, firewall status, firmware update settings, and DDNS settings are also leaked publicly.

What are the risks of leaking this information publicly?

A MAC address is a unique identifier for every networked device. Mobile devices, such as smartphones and laptops, share this identifier every time they connect to a wireless network. This creates a fingerprint that can be used to track that device’s movement across networks.

If a device’s name includes the full name of the owner, this flaw allows attackers to determine the identity of owner and geolocate them via the Linksys Smart Wi-Fi router’s public IP address.

While geolocation by IP address is not precise, services like WiGLE allow anyone to get the exact geographical coordinates of a WiFi network based solely on its MAC address or SSID. An attacker can query the target Linksys Smart Wi-Fi router, get it’s MAC address, and immediately geolocate it.

In any scenario, publicly leaking the historical record of every device that’s ever connected to the Linksys Smart Wi-Fi router is a privacy concern that shouldn’t be taken lightly. This information allows attackers to gain visibility inside your home or business network, enabling them to conduct targeted attacks.

Is there any connection to the ShadowHammer attacks?

Of the 756,565 unique MAC addresses currently being leaked, only two were referenced in the ShadowHammer attacks. However, it’s not likely either were targeted directly. The first match, 0c:5b:8f:27:9a:64, appears to be frequently reused by Huawei. The second was the VMware default (00:50:56:c0:00:08) and was targeted only if it paired with a secondary MAC address.

Did you find the German mail bomber?

The MAC address used by the German mail bomber ( f8:e0:79:af:57:eb ) was not found.

What is Home Network Administration Protocol (HNAP)?

HNAP is a SOAP-based protocol used to manage and configure consumer routers. Cisco acquired and took over development of the protocol in 2009 . Numerous HNAP-related vulnerabilities have been identified in the last six years. Large-scale exploitation of HNAP flaws by “TheMoon” botnet was discovered by security researchers in 2014 .

Are there other HNAP vulnerabilities?

Yes, an unauthenticated attacker can quickly enumerate which Linksys Smart Wi-Fi routers have not changed the default password (admin) without even attempting to login to the device. The can be done by simply querying the following JNAP endpoint:

X-JNAP-ACTION: http://cisco.com/jnap/core/IsAdminPasswordDefault

Our scans have found thousands of routers are still using the default password and are vulnerable to immediate takeover – if they aren’t already compromised..

Admin access to the Linksys Smart Wi-Fi router allows attackers to:

• • Obtain the SSID and Wi-Fi password in plaintext
  • Change the DNS settings to use a rogue DNS server tohijack web traffic
  • Open ports in the router’s firewall to directly target devices behind the routers (example: 3389/tcp for Windows RDP)
  • Use UPnP to redirect outgoing traffic to the threat actors’ device
  • Create an OpenVPN account (supported models) to route malicious traffic through the router
  • Disable the router’s internet connection or modify other settings in a destructive manner

What specific models of Linksys Smart Wi-Fi routers are vulnerable?

Our research has found the models listed below are actively leaking sensitive information, including those running the latest firmware available from Linksys.

The full list of vulnerable models and firmware versions is available here .

Where are the vulnerable routers located?

This interactive map shows the total vulnerable Linksys Smart Wi-Fi routers found per country.

Of the vulnerable routers found, most were located in the United States.

Overall, a grand total of 25,617 vulnerable routers were found in 146 countries and on the network of 1,998 unique autonomous systems (internet service providers).

Wasn’t this issue patched five years ago?

While CVE-2014-8244 was supposedly patched for this issue, our findings have indicated otherwise. Upon contacting the Linksys security team ( [email protected] ) we were advised to report the vulnerability via this form . After submitting our findings, the reviewing analyst determined the issue was “Not applicable / Won’t fix” and subsequently closed.

Is there any good news?

Over half of the vulnerable Linksys Smart Wi-Fi routers (14,387) currently have automatic firmware updates enabled. If Linksys eventually patches this vulnerability, these routers will be protected automatically.

Closing remarks

Due to the sensitive nature of this vulnerability, the IP addresses of the affected Linksys Smart Wi-Fi routers will not be published publicly.

Unfortunately, our typical recommendation of keeping your router’s firmware up-to-date is not applicable in this case as no fix is available. Linksys Smart Wi-Fi routers have remote access enabled by default, as it’s required for the Linksys App to function, and cannot be turned off as a workaround.

Follow us on Twitter for latest emerging threats and botnet trends.