Consumer Broadband ISP Routers Exposed via New Backdoor Exploit

---

Broadband ISP customers that own some models of Cisco, Netgear, Linksys or certain other routers could be vulnerable to a new backdoor exploit that allows a hacker to remotely input their own admin password and possibly gain full access to your network.

The hack, which has been published by Eloi Vanderbeken on Github (note: more details via Hacker News), is increasingly believed to be common among devices that were physically manufactured, on behalf of the big router firms, by Sercomm.

Vanderbeken noted that many of these devices, such as for example Netgear’s DGN2000 and DG834B, appeared to be listening on an undocumented service via TCP port 32764 (note: not all models will listen via this port over the Internet / WAN but some do).

A little reverse engineering later and Vanderbeken found that he could send commands to the router via this port and without needing an administrator’s password. At this stage his access was still limited but it didn’t take him long to figure out how to reset the admin password for full access.
The exploit is also believed to be present in a number of other routers, although we’ve only listed the fully confirmed ones above. On some models the simplest solution to this exploit is to create a new Firewall Rule in your router that blocks access to TCP 32764, although it’s noted that this didn’t appear to work on the Cisco RVS4000 and others may share a similar problem.

---