KCodes NetUSB flaw impacts millions of SOHO routers

Cybersecurity experts discovered a flaw in the KCodes NetUSB component that impacts millions of end-user routers from different vendors

Cybersecurity researchers from SentinelOne have discovered a critical vulnerability (CVE-2021-45608) in KCodes NetUSB component that is present in millions of end-user routers from different vendors, including Netgear, TP-Link, Tenda, EDiMAX, D-Link, and Western Digital.

NetUSB is a product developed by KCodes to allow remote devices in a network to interact with USB devices connected to a router. Users could interact with a printer or a hard drive plugged into a router via network using a driver on their computer that allows communication with the network device.

The flaw is a buffer overflow vulnerability that can be exploited by remote attackers to execute code in the kernel and carry out malicious activities.

According to the report published by SentinelOne, a threat actor could send crafted commands to internet-connected routers on port 20005.

“While going through various paths through various binaries, I came across a kernel module called NetUSB. As it turned out, this module was listening on TCP port 20005 on the IP 0.0.0.0.” reads the report. “Provided there were no firewall rules in place to block it, that would mean it was listening on the WAN as well as the LAN. Who wouldn’t love a remote kernel bug?”

The vulnerability was discovered by SentinelOne researcher Max Van Amerongenwho explained that the issue is not easy to exploit. exploiting this issue. The good news is that SentinelOne is not aware of any active exploitation attempts for CVE-2021-45388.

SentinelOne reported the issue to KCodes, and in October the company released security updates to address this flaw.

“This vulnerability affects millions of devices around the world and in some instances may be completely remotely accessible. Due to the large number of vendors that are affected by the vulnerability, we reported this vulnerability directly to KCodes to be distributed among their licensees instead of targeting just the TP-Link or the Netgear device in the contest. This ensures that all vendors receive the patch instead of just one during the contest.” concludes the report. “While we are not going to release any exploits for it, there is a chance that one may become public in the future despite the rather significant complexity involved in developing one. We recommend that all users follow the remediation information above in order to reduce any potential risk.”

Unfortunately, it is impossible to know which are the vendors that already applied the security updates released by the company. At the time of this writing, only Netgear has released security updates for its impacted models.

In May 2015, the security expert Stefan Viehbock from SEC Consult Vulnerability Lab reported a critical vulnerability (CVE-2015-3036) that potentially affected millions of routers and Internet of Things devices using the KCodes NetUSB component. An attacker could have exploited the flaw in the NetUSB to remote hijacking the devices or to cause a denial of service attack.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, KCodes NetUSB)

---