Submitted 6 months ago by maya@discuss.tchncs.de to technology@beehaw.org
Today I scanned my router with routersploit. The scan ended and showed one vulnerability: eseries_themoon_rce.
I searched the internet and found that this is a vulnerability in Linksys E-Series routers. But I am not on linksys at all. And I didn’t find anything about getting rid of it.
I’m wondering if someone knows how to make this vulnerability eliminate?
Looks like there’s a metasploit available. You can use that on your router to see if it’s susceptible. A quick google search indicates that this is only successful on older routers without input validation.
In general, follow good cyber security hygiene, and update the firmware on your router. If your router no longer is supported by the vendor (no more firmware updates for vulnerabilities found), then it’s old and you should upgrade.
You might also be able to replace the firmware with something like DD-WRT or OpenWRT or Tomato or other third-party firmware.
Good idea.
You can still get the newest DD-WRT builds even on the WRT54G.
That is a Wi-Fi router from 2002.
Of course, the features are sort of limited. I tried the VPN build (on WRT54GL), but I couldn’t get the OpenVPN client to connect. I found some thread mentioning it may be missing something, but I don’t know if that’s the issue.
Anyway, without overclocking I’d expect like 2Mbps. I mean, it barely handles HTTPS. Just trying to load the WebUI maxes out the CPU for several seconds if trying to use HTTPS.
Perhaps it’s not missing anything software-wise, but it’s just so slow it times out during handshake.
So I just put the std build on it in case it will be useful at some point.
Thank you for advice and additional info. I bought a modern router Cudy WR3000 with WiFi-6 support. And it has the last firmware update available.
Areldyb@beehaw.org 6 months ago
If your router isn’t even a Linksys router, then it’s most likely a false positive result and can be safely ignored. If you want to be extra sure, you could attempt to actually exploit the vulnerability with routersploit and see whether you get anywhere.
In general, the fix for a vulnerability in an end-user network device is some combination of “update the firmware” and “disable the vulnerable feature”.
maya@discuss.tchncs.de 6 months ago
Hi, thank you for your answer. I solved the problem. I performed a router factory reset. After that I run the security test again and it didn’t find any vulnerabilities.