More Wi-Fi devices with security holes

On his blog, German security expert Michael Messner has identified more Wi-Fi access devices that contain security holes of varying severity. Recently, the researcher uncovered a number of vulnerabilities in devices from Linksys, Netgear and D-Link.

The holes that are now being disclosed affect the Edimax EW-7206APg and EW-7209APg as well as TP-Link's TL-WA701N access points, the Linksys WRT160N router, Netgear's DGN2200B ADSL modem, and Raidsonic's IB-NAS5220 and IB-NAS4220-B NAS devices. In all cases, Messner had reported the flaws to the affected vendors many weeks ago; however, he says he has either received no response at all (TP-Link) or that manufacturers don't intend to provide updates (Edimax, Raidsonic) or have released updates without providing any details about what has been fixed (Netgear). Messner notes that Linksys didn't respond at all for over two months.

The wide range of vulnerabilities include the possibility of extracting password files without authentication (TP-Link) or executing arbitrary shell commands (in Raidsonic and Netgear devices without authentication, in Linksys devices with authentication), as well as passwords that are stored in plain text (Netgear). Many devices are also vulnerable to cross-site scripting (XSS) attacks.

(djwm)