Hundreds of thousands of Wifi manufactured from 2015 and earlier were attacked

Critical vulnerabilities have been found in hundreds of Wi-Fi models for home use. They are manufactured and sold by 65 different companies and are under attack. The list of hacked models is listed at the bottom of the page.

Many of the hacked models were manufactured between 2010 and 2015, with at least a few manufactured in 2004. IoT Inspector, a German information security company, discovered hundreds of thousands of vulnerable personal devices worldwide.

"By exploiting these vulnerabilities, remote unauthenticated attackers can fully compromise the device and execute arbitrary code with the highest level of privileges," IoT Inspector said.

In the IoT Inspector report published on August 16, a criminal gang attacked these devices.

Israeli information security company SAM Seamless Network said it took just two days for botnet operators to use a variant of the notorious Mirai malware. On an October 2016 afternoon, that variant brought down Internet access in much of the US East Coast and began carrying out the attack.

The botnet gang is exploiting a specific vulnerability related to remote router takeover via the admin interface. Even disabling remote access cannot fix this problem.

Just accessing a malicious website on a computer with a router puts the user at risk. In addition, there are three other critical vulnerabilities.

Hundreds of thousands of Wifi manufactured from 2015 and earlier were attacked Picture 1

These vulnerable devices all use Wifi chips manufactured by Realtek Company (Taiwan). In May, IoT Inspector informed Realtek of this vulnerability. On August 13, the company released patches for some Wi-Fi with vulnerable chipsets. Realtek is expected to roll out more patches, but has no plans to patch the oldest chipsets.

However, those patches must be made and tweaked by the vulnerable device manufacturers and then made available to users as new firmware.

Having patches available to download or install is less likely, and it may take several months before all firmware updates become available. The oldest devices will probably never receive the patch.

What to do when your Wifi on the list is attacked?

If the Wifi is only a few years old, say 2015 or later: You will probably receive a firmware update in the next few months.

Check the manufacturer's website now for updates released after August 13, 2021. See a firmware release that notes the vulnerability ID numbers CVE-2021-35392, CVE-2021 -35393, CVE-2021-35394 or CVE-2021-35395 or not. If so, contact Realtek or IoT Insprctor for assistance in locating the error.

Follow the instructions on the manufacturer's website to download and install the firmware.

If an update is not available, disconnect the device and use another router or access point until a firmware update is available.

If the device was manufactured between 2010 and 2015: You may or may not receive a firmware update. You do the same as above: Check the manufacturer's website for available firmware updates and follow the instructions.

If there is no new release as of August 13, 2021, disconnect the device and keep checking the site for the next few months.

If the device was first manufactured before 2010: You will probably never receive the firmware update, so you should buy a new Wifi.

List of hacked Wifi

Micah Soto

Update 24 August 2021