This vulnerability chain could be easily exploited by an attacker by tricking the device's users into visiting a maliciously crafted page. In the case of the Netgear Nighthawk M1 Mobile router, a cross-site request forgery bypass (tracked as CVE-2019-14526) and a post-authentication command injection ( CVE-2019-14527) could allow potential attackers to execute arbitrary code on the vulnerable device if 'the user hasn’t set a strong password on the web interface.' The Pen Test Partners researcher also found security issues in 4G routers manufactured by Netgear and TP-LINK, with at least four of them also having been assigned CVEs. CVE-2019-3412 – Arbitrary Command Execution (9.8 critical severity CVSS v3.0 base score) Security flaws found in Netgear and TP-LINK 4G routers.CVE-2019-3411 – Information Leak (7.5 high severity CVSS v3.0 base score).The following issues were discovered while examining the MF910 and MF65 routers, issues that the vendor will not patch: This time, ZTE decided to fix the reported flaws which also got assigned CVE identifiers. The researcher subsequently tested another ZTE router, the MF920, which shared the same codebase and, as a result, almost the same vulnerabilities. The vendor that really stood out in the eyes of the researchers was ZTE, who brushed off the vulnerabilities identified in the MF910 and MF65+ routers as they affected end-of-life products-even though, in the case of the MF910, it was still listed on the company's website with no hint at it being out of support (advisory available HERE). The worst part is that the security flaws were discovered after examining a limited set of 4G routers, covering the entire prices spectrum, from consumer-grade routers and dongles to very pricey devices designed to be used in large enterprise networks.Īll the security flaws found were reported to the vendors who fixed most of the discovered issues before the Pen Test Partners report was published but, unfortunately, the disclosure process didn't go as smooth as expected.

'Plus, there’s only a small pool of OEMs working seriously with cellular technologies, and their hardware (& software dependencies) can be found running in all sorts of places.' 'We found critical remotely-exploitable flaws in a selection of devices from variety of vendors, without having to do too much work,' Richter said. Pen Test Partners researcher 'G Richter' shared the flaws found in 4G devices during this year's DEF CON hacking conference, saying that 'a lot of existing 4G modems and routers are pretty insecure.' Multiple vulnerabilities were found by security researchers in 4G routers manufactured by several companies, with the flaws exposing users to information leaks and command execution attacks.

Zte exploit researcher