‘Cable Haunt’ Bug Plagues Millions of Home Modems

2020-01-13 15:37

UPDATED. Multiple cable modems used by ISPs to provide broadband into homes have a critical vulnerability in their underlying reference architecture that would allow an attacker full remote control of the device.

Dubbed "Cable Haunt" by researchers at Lyrebirds, the bug is found in cable modems across multiple vendors, including Arris, COMPAL, Netgear, Sagemcom, Technicolor and others.

More specifically, "The cable modems are vulnerable to a DNS rebind attack followed by overflowing the registers and executing malicious functionality," explained the researchers, in a technical paper on the attack.

Many of the same modems are used in North America, so Cable Haunt isn't restricted by geography.

If successfully exploited, the vulnerabilities can give attackers "Full remote control over the entire unit, and all the traffic that flows through it, while being invisible for both the user and ISP," the researchers explained, adding that attackers could intercept private messages, redirect traffic, add the modems to botnets, replace their firmware and more.

News URL

https://threatpost.com/cable-haunt-remote-code-execution/151756/