The bug was serious enough that the NSA warned Zyxel customers to patch immediately. Jake Baines of Rapid7 discovered a bug in assorted Zyxel devices. Hackers are exploiting critical bug in Zyxel firewalls and VPNsīy Ionut Ilascu of BleepingComputer May 15, 2022 Paying lots of money does not get you security
Quoting: "Netgear has admitted that multiple security vulnerabilities in its business-grade BR200 and BR500 VPN routers can't be fixed due to technical limitations outside of their control, and is offering users a free or discounted replacement router.". Two business-grade Netgear VPN routers have security vulnerabilities that can't be fixedīy Zeljka Zorz of Help Net Security May 20, 2022 All the bugs are now displayed belowĢ017 bugs 2016 bugs 2015 bugs 2014 bugs 2013 bugs 2012 bugs 2011 bugs 2010 bugs 20 To see all the bugs on one B_I_G web page (makes it easy to find all the issues for any one manufacturer) click this button =>ĭONE. Older bugs, from 2017 through 2012, are available at the bottom of this page. A lawsuit alleged that D-Link "failed to take reasonable steps to protect their routers and IP cameras from widely known and reasonably foreseeable risks of unauthorized access." D-Link was also accused of misleading the public about the security of their devices. THE US GOVERNMENT: In January 2017, the FTC accused D-Link of leaving its routers and webcam devices vulnerable to hackers.
Other huge flaws involved UPnP being exposed to the Internet and file sharing on a USB port. Then, of course, there is WPS, the electronic equivalent of a "hack me" sign on your back. Another flaw not to be missed is the Misfortune Cookie from December 2014.
A router backdoor was exposed, then instead of being removed, was just better hidden. The port 32764 issue from January 2014 and April 2014 for example.
Another reason is cost: router software is developed as cheaply as possible.īIG BUGS: A number of flaws stand out. One reason for this is your ISP, which may have configured the router/gateway in an insecure way, either on purpose, to allow spying, or out of laziness or incompetence. You may be thinking that all software is buggy, but router software is probably worse. Starting April 2018, I also track routers in the news which details the exploitation of router flaws. This page documents the existence of bugs in routers. On the whole, the software in these routers is buggy as heck. To the extent possible under law, Jake Jarvis has waived all copyright and related or neighboring rights to this work.If you care about the security of your router, and you should, it is best to avoid consumer grade routers. If you've found any other juicy Shodan gems, whether it's a search query or a specific example, definitely drop a comment on the blog or open an issue/PR here on GitHub. Port 17 ( RFC 865) has a bizarre history. → "Minecraft Server" "protocol 340" port:25565 http.html:"* The wp-config.php creation script uses this file" http.title:"Index of /" http.html:".pem"Įxposed wp-config.php files containing database credentials. pem with any extension or a filename like phpinfo.php. Industrial Control Systems Samsung Electronic Billboards To that end, I hope this list spreads awareness (and, quite frankly, pant-wetting fear) rather than harm.Īnd as always, discover and disclose responsibly! The world and its devices are quickly becoming more connected through the shiny new Internet of Things Sh*t - and exponentially more dangerous as a result. For your own legal benefit, do not attempt to login (even with default passwords) if they aren't! Narrow down results by adding filters like country:US or org:"Harvard University" or hostname:"" to the end. You can assume these queries only return unsecured/open instances when possible.
Most search filters require a Shodan account. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild. Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the ( literal) internet search engine.