More than 135 Million modems around the world are vulnerable to a flaw that can be exploited remotely to knock them offline by cutting off the Internet access. The simple and easily exploitable vulnerability has been uncovered in one of the most popular and widely-used cable modem, the Arris SURFboard SB6141, used in Millions of US households. Security researcher a loophole that made these modems vulnerable to unauthenticated reboot attacks. He also released his "exploit" after Arris (formerly Motorola) stopped responding to him despite a responsible disclosure. The Bug is quite silly: No Username and Password Protection. Arris does not provide any password authentication set up on the modem's user interface, thus allowing any local attacker to access the administration web interface at 192.168.100.1 without the need to enter a username and password. This issue allows a local attacker to ' ' from the 'Configuration page' of the administrative interface at , as shown. This is nothing but a (DoS) attack. Bingo! By clicking 'Restart Cable Modem' manually will disable victim's modem for 2 to 3 minutes and every device on that network will lose access to the Internet. However, three minutes of no Internet connectivity is bearable, but the same administrative panel provides an option to Factory Reset the modem as well i.e. wipe out modem's configuration and settings. If an attacker clicks this option, your modem will go offline for 30 minutes as re-configuration process takes as long as an hour to complete. Though, sometimes you need to call your Internet Service Provider (ISP) to reactivate the modem. David revealed that an attacker can also reset your modem remotely, as the application doesn't verify whether the reboot or reset the modem command comes from the UI interface or an external source. This remote attack is known as a Cross-Site Request Forgery (CSRF) attack that allows an attacker to use social engineering techniques to trick users into clicking on a specially crafted web page or email. For example: A web page including <img src="https://malicious_url/"> tag could call any of the following URLs: However, these flaws are easily patchable that only requires Arris to create a firmware update such that: However, the bad news is that there's no practical fix for the flaws. Since cable modems are not consumer-upgradable, even if Arris releases a fix, you would need to wait for your ISPs to apply the fix and push the update to you. Arris has recently addressed the flaws with a firmware update.
Researchers have discovered that more than 135m modems worldwide are potentially vulnerable to unauthenticated reboot attacks. The flaw has been discovered in the Arris (formerly ISP) SURFboard SB6141, which is particularly popular in the US. Arris does not provide password authentication set up on the modem’s user interface. As a result, any local attacker can access the administration web interface without a username or password. This allows the attacker to disable the user’s modem for up to three minutes, or as much as an hour if the perpetrator chooses the option to Factory Reset the modem. This in turn, wipes the modem’s configurations and settings. The flaws are patchable but given that consumers cannot upgrade cable modems they have to wait for their Motorola to take the remedial action.