A security firm has revealed that a simple mistake in a Linux device kernel could be putting millions of Wi-Fi routers at risk.

SEC Consult Vulnerability Lab has discovered the flaw, which Ars Techinca refers to as “amateurish,” in a driver referred to as NetUSB. The driver, as its name suggests, is installed on routers to allow computers to access USB devices over a network.

Advertisement

Sadly, the driver contains an error known as a buffer overflow, which can occur when a device sends its name to the router and it’s longer than 64 bytes. The researchers claim that the simple overflow can be used to crash the router, using denial of service of attacks, and even execute code remotely.

Ars Technica is right: this is an amateurish error, and the researchers agree. In a blog post about the bug, they even joke that the “the ‘90s are calling and want their vulns back, stack buffer overflow.” Such simple errors don’t usually happen much these days—but clearly this one slipped through the net.

Advertisement

Fortunately, SEC Consult Vulnerability Lab has published a (non-exhaustive) list of the routers it knows to be affected, which is reproduced below. Among them are those produced by Netgear, D-Link, TP-Link, Western Digital and others, and the number affected could, according to the team, run into the millions.

Advertisement

Sadly, Netgear has told the researchers that even with NetUSB functionality disabled the driver’s still actually loaded—so firmware updates entirely removing it are required. TP-Link’s aiming to do that by the end of the month; the response from other manufacturers is less clear. In the meantime, it might be a good idea to check the list to put your mind at rest. [Ars Technica, SEC Consult Vulnerability Lab]

D-Link DIR-615 C

NETGEAR AC1450

NETGEAR CENTRIA (WNDR4700/4720)

NETGEAR D6100

NETGEAR D6200

NETGEAR D6300

NETGEAR D6400

NETGEAR DC112A

NETGEAR DC112A (Zain)

NETGEAR DGND4000

NETGEAR EX6200

NETGEAR EX7000

NETGEAR JNR3000

NETGEAR JNR3210

NETGEAR JR6150

NETGEAR LG6100D

NETGEAR PR2000

NETGEAR R6050

NETGEAR R6100

NETGEAR R6200

NETGEAR R6200v2

NETGEAR R6220

NETGEAR R6250

NETGEAR R6300v1

NETGEAR R6300v2

NETGEAR R6700

NETGEAR R7000

NETGEAR R7500

NETGEAR R7900

NETGEAR R8000

NETGEAR WN3500RP

NETGEAR WNDR3700v5

NETGEAR WNDR4300

NETGEAR WNDR4300v2

NETGEAR WNDR4500

NETGEAR WNDR4500v2

NETGEAR WNDR4500v3

NETGEAR XAU2511

NETGEAR XAUB2511

TP-LINK Archer C2 V1.0 (Fix planned before 2015/05/22)

TP-LINK Archer C20 V1.0 (Not affected)

TP-LINK Archer C20i V1.0 (Fix planned before 2015/05/25)

TP-LINK Archer C5 V1.2 (Fix planned before 2015/05/22)

TP-LINK Archer C5 V2.0 (Fix planned before 2015/05/30)

TP-LINK Archer C7 V1.0 (Fix planned before 2015/05/30)

TP-LINK Archer C7 V2.0 (Fix already released)

TP-LINK Archer C8 V1.0 (Fix planned before 2015/05/30)

TP-LINK Archer C9 V1.0 (Fix planned before 2015/05/22)

TP-LINK Archer D2 V1.0 (Fix planned before 2015/05/22)

TP-LINK Archer D5 V1.0 (Fix planned before 2015/05/25)

TP-LINK Archer D7 V1.0 (Fix planned before 2015/05/25)

TP-LINK Archer D7B V1.0 (Fix planned before 2015/05/31)

TP-LINK Archer D9 V1.0 (Fix planned before 2015/05/25)

TP-LINK Archer VR200v V1.0 (Fix already released)

TP-LINK TD-VG3511 V1.0 (End-Of-Life)

TP-LINK TD-VG3631 V1.0 (Fix planned before 2015/05/30)

TP-LINK TD-VG3631 V1.0 (Fix planned before 2015/05/31)

TP-LINK TD-W1042ND V1.0 (End-Of-Life)

TP-LINK TD-W1043ND V1.0 (End-Of-Life)

TP-LINK TD-W8968 V1.0 (Fix planned before 2015/05/30)

TP-LINK TD-W8968 V2.0 (Fix planned before 2015/05/30)

TP-LINK TD-W8968 V3.0 (Fix planned before 2015/05/25)

TP-LINK TD-W8970 V1.0 (Fix planned before 2015/05/30)

TP-LINK TD-W8970 V3.0 (Fix already released)

TP-LINK TD-W8970B V1.0 (Fix planned before 2015/05/30)

TP-LINK TD-W8980 V3.0 (Fix planned before 2015/05/25)

TP-LINK TD-W8980B V1.0 (Fix planned before 2015/05/30)

TP-LINK TD-W9980 V1.0 (Fix already released)

TP-LINK TD-W9980B V1.0 (Fix planned before 2015/05/30)

TP-LINK TD-WDR4900 V1.0 (End-Of-Life)

TP-LINK TL-WR1043ND V2.0 (Fix planned before 2015/05/30)

TP-LINK TL-WR1043ND V3.0 (Fix planned before 2015/05/30)

TP-LINK TL-WR1045ND V2.0 (Fix planned before 2015/05/30)

TP-LINK TL-WR3500 V1.0 (Fix planned before 2015/05/22)

TP-LINK TL-WR3600 V1.0 (Fix planned before 2015/05/22)

TP-LINK TL-WR4300 V1.0 (Fix planned before 2015/05/22)

TP-LINK TL-WR842ND V2.0 (Fix planned before 2015/05/30)

TP-LINK TL-WR842ND V1.0 (End-Of-Life)

TP-LINK TX-VG1530(GPON) V1.0 (Fix planned before 2015/05/31)

Trendnet TE100-MFP1 (v1.0R)

Trendnet TEW-632BRP (A1.0R)

Trendnet TEW-632BRP (A1.1R/A1.2R)

Trendnet TEW-632BRP (A1.1R/A1.2R/A1.3R)

Trendnet TEW-634GRU (v1.0R)

Trendnet TEW-652BRP (V1.0R)

Trendnet TEW-673GRU (v1.0R)

Trendnet TEW-811DRU (v1.0R)

Trendnet TEW-812DRU (v1.0R)

Trendnet TEW-812DRU (v2.xR)

Trendnet TEW-813DRU (v1.0R)

Trendnet TEW-818DRU (v1.0R)

Trendnet TEW-823DRU (v1.0R)

Trendnet TEW-MFP1 (v1.0R)

Zyxel NBG-419N v2

Zyxel NBG4615 v2

Zyxel NBG5615

Zyxel NBG5715