Major emergency patches issued for routers against hackers — get it now

By Kim Komando

April 10, 2019

You may be religiously keeping all your devices and applications up to date, but there might be one critical thing you’re neglecting. It’s that one device that acts as your gatekeeper for all the data going in and out of your home.

We’re talking about your router, that little device you connect gadgets to for internet access. You probably don’t think about your home’s router all that much. Unless of course, you are having problems like slowdowns or a lost internet connection.

But did you know that this neglect and lack of interaction with your router could be a big security issue? For example, serious vulnerabilities were discovered on this major ISPs’ routers that can put millions at risk. Are you safe? Read on and find out.

Verizon FiOS router security issues

If you’re on Verizon FiOS, you better check your router now. Three new critical security flaws in the Verizon FiOS Quantum Gateway (G100) were discovered, all of which could allow an attacker to take full control of the device.

The vulnerabilities can all lead to a full chain of exploits and they include:

CVE-2019-3914 – A flaw that could allow an attacker to inject commands on the router’s operating system. To pull this off, the attacker has to be authenticated by the router’s web administration interface and has to be connected to your local network already. An attacker can also launch this attack in some cases where remote administration on the router is enabled.

CVE-2019-3915 – This flaw allows an attacker to gain access to the router’s web interface by intercepting login requests. Since the router’s web interface is not secured by HTTPS, the attacker could sniff the requests and replay them. From there, they can execute CVE-2019-3914 to gain full control of the router.

CVE-2019-3916 – This flaw allows an attacker to steal the value of the password salt used for the administrator interface then use a brute force dictionary attack to unlock the original password. (Note: A “salt” is randomly generated data used in password encryption.) Related to CVE-2019-3915, this is possible since the router’s web interface is not secured by HTTPS, allowing an attacker to sniff out and duplicate the login requests.

Researchers at security firm Tenable reported the vulnerabilities to Verizon earlier this year, but in line with “responsible disclosure” practices, gave the carrier enough time to develop patches before revealing the bugs publicly.

And it looks like the time is now. Verizon has quietly released a firmware update (02.02.00.13) to the Quantum Gateway (G100) routers to address the vulnerabilities.

In fact, the firmware update started rolling out on March 1, but according to Bleeping Computer, some users complained that the update caused problems.

Verizon said that by this time, the patch has already been fully deployed but a small percentage of the affected routers may still need to be patched as of April 5. The company also said there are no signs that the flaws were ever exploited.

Here’s Verizon’s official statement:

“We were recently made aware of three vulnerabilities related to login and password information on the Broadband Home Router Fios-G1100. As soon as we were made aware of these vulnerabilities, we took immediate action to remediate them and are issuing patches. We have no evidence of abuse and there is no action required of our consumers.”

What can you do if you have Verizon FiOS?

If you have Verizon FiOS, it’s very likely that you have the affected Quantum Gateway (G100) router.

Verizon pushes out the firmware updates to your router automatically but if you want to manually check if your firmware version is the latest, here are the steps:

1. On a web browser, go its web administration page by typing 192.168.1.1 on your browser address bar. This is the default address of the router and unless you’ve changed it, it will take you directly to that page.
2. Sign in by using your administrator password. This can be located on the side of your router.
3. Once logged in, click on the tab labeled “System Monitoring.”
4. Here, you’ll see your router’s firmware version. Make sure it’s on 02.02.00.13 or later.

Please check for router firmware updates regularly

Even if you’re not on Verizon FiOS, or if you own another router model or brand, security vulnerabilities like these can happen any time. This is why checking for router firmware updates regularly is a critical step to your security.

Updating your router’s firmware is not as difficult as it sounds. It depends on your router brand and model, but all of them have an administrator page you can access via browser. All you have to do is type the default IP address of your particular router on your browser address bar and that will take you directly to that page.

Common IP addresses for popular routers are 192.168.0.1 for Virgin Media’s Super Hub 2, 192.168.1.1 for Linksys and D-Link, 192.168.0.1 for Netgear, or 192.168.2.1 for Belkin. If you’re having trouble finding your router’s IP, consult your user manual or you can check online for lists such as routeripaddress.com.

Once you’re on the router administrator page, most of the time, you will have to enter a username and password to log in (while you’re at it, please change your router’s default username and password for obvious security reasons). Once logged in, check for a section called “Advanced” or “Management” to check for firmware updates.

Usually, you will have the option to check, review, download and install your router’s new firmware on the same page. Again, it depends on your router model, so check your user manual for detailed directions on how to do this.

Keep in mind, router firmware updates require a restart so make sure you don’t have ongoing activities that require a network connection when you apply the update.

And lastly, for peace of mind, it is recommended that you check for router firmware updates at least once every three months.

Tags: operating systems, web browser