Researchers have discovered that more than 135m modems worldwide are potentially vulnerable to unauthenticated reboot attacks. The flaw has been discovered in the Arris (formerly ISP) SURFboard SB6141, which is particularly popular in the US. Arris does not provide password authentication set up on the modem’s user interface. As a result, any local attacker can access the administration web interface without a username or password. This allows the attacker to disable the user’s modem for up to three minutes, or as much as an hour if the perpetrator chooses the option to Factory Reset the modem. This in turn, wipes the modem’s configurations and settings. The flaws are patchable but given that consumers cannot upgrade cable modems they have to wait for their Motorola to take the remedial action.
Researchers have discovered that more than 135m modems worldwide are potentially vulnerable to unauthenticated reboot attacks. The flaw has been discovered in the Arris (formerly Motorola) SURFboard SB6141, which is particularly popular in the US. Arris does not provide password authentication set up on the modem’s user interface. As a result, any local attacker can access the administration web interface without a username or password. This allows the attacker to disable the user’s modem for up to three minutes, or as much as an hour if the perpetrator chooses the option to Factory Reset the modem. This in turn, wipes the modem’s configurations and settings. The flaws are patchable but given that consumers cannot upgrade cable modems they have to wait for their ISP to take the remedial action.