<div class="field field-name-field-news-column-category field-type-taxonomy-term-reference field-label-hidden"><div class="field-items"><div class="field-item even"><a href="/tags/%E6%96%B0%E8%81%9E">新聞</a></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"> <p>多個型號的家用路由器很可能因為採用相同廠牌韌體，而存在同樣的漏洞，成為攻擊者鎖定的目標。例如，在2020年11月由資安媒體CyberNews揭露<a href="http://www.ithome.com.tw/news/141278">數款品牌的路由器存在後門漏洞</a>，而有攻擊者藉此散布殭屍病毒Mirai的情況：這些廠牌包含Walmart獨家銷售的Jetstream，以及透過Amazon與eBay販賣的Wavlink。資安研究員發現，上述兩個品牌的路由器，都是中國業者Winstars生產，而存在相同的漏洞。</p>
<p>但這種多款路由器產品使用含有漏洞的韌體，而存在相同漏洞的情況最近又再度發生。研究人員發現橫跨數十個廠牌與ISP、影響數以百萬設備的重大漏洞，一旦攻擊者濫用，就能繞過網頁管理界面的身分驗證機制，而掌控路由器來發動攻擊，且被揭露不久已出現攻擊行動。</p>
<p>在8月3日，弱點管理解決方案業者Tenable公布<a href="http://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2">繞過驗證漏洞CVE-2021–20090的細節</a>，<a href="https://www.tenable.com/cve/CVE-2021-20090">此漏洞的CVSS風險層級達9.8分</a>，影響19個廠牌、總共37款路由器設備，而這些設備的共同點，都是採用臺灣綜合接入設備（IAD）製造商智易科技（Arcadyan）的韌體。</p>
<p>智易科技成立於2003年，總部位於新竹科學園區，是仁寶旗下的子公司。該公司是全球綜合接入設備的大型製造商，提供寬頻網路、無線網路、光纖網路路由器，以及機上盒等產品。</p>
<p>這項漏洞最早被發現的起緣，是Tenable於今年的年初，取得日本一款相當暢銷的路由器設備Buffalo WSR-2533進行研究，所找到的其中一項漏洞。但資安研究人員進一步調查發現，還有其他使用智易科技韌體的路由器，也存在相同漏洞。Tenable於4月下旬通報智易科技後，智易科技確認相關漏洞，並表明他們與其中一家廠商正在修補中，但不願向Tenable透露可能受影響的廠商名單。</p>
<p>針對CVE-2021–20090，<a href="https://zh-tw.tenable.com/security/research/tra-2021-13?tns_redirect=true">Tenable於4月26日首度發出資安通告</a>，並於7月20日公布其他受到影響的路由器名單，最後在8月3日發表此漏洞的細節，並提供概念性驗證（PoC）攻擊手法與影片。</p>
<blockquote class="twitter-tweet"><p dir="ltr" lang="en" xml:lang="en">A little video demo from the Buffalo writeup ( <a href="https://t.co/ySft5EP299">https://t.co/ySft5EP299</a> ) : <a href="https://t.co/1ulDi0CyXZ">pic.twitter.com/1ulDi0CyXZ</a></p>
<p>— evan grant (@stargravy) <a href="https://twitter.com/stargravy/status/1422550311814762503?ref_src=twsrc%5Etfw">August 3, 2021</a></p></blockquote>
<script async="" src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>受到此繞過驗證漏洞影響的路由器，出現於華碩、Buffalo，以及智易科技的自有品牌，還有多家ISP業者也有存在相同漏洞的路由器機種，如：英國電信、德國電信、Verizon、Vodafone等。</p>
<table border="0" cellpadding="0" cellspacing="0" height="878" style="width:415px;" width="415" xmlns="http://www.w3.org/1999/xhtml"><tbody><tr height="22"><td data-sheets-value="{"1":2,"2":"Vendor"}" height="22" style="height:22px;width:140px;">廠牌</td>
<td data-sheets-value="{"1":2,"2":"Device"}" style="width:275px;">路由器機種</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"ADB"}" height="22" style="height:22px;">ADB</td>
<td data-sheets-value="{"1":2,"2":"ADSL wireless IAD router"}">ADSL wireless IAD router</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Arcadyan"}" height="22" style="height:22px;">Arcadyan</td>
<td data-sheets-value="{"1":2,"2":"ARV7519"}">ARV7519</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Arcadyan"}" height="22" style="height:22px;">Arcadyan</td>
<td data-sheets-value="{"1":2,"2":"VRV9517"}">VRV9517</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Arcadyan"}" height="22" style="height:22px;">Arcadyan</td>
<td data-sheets-value="{"1":2,"2":"VGV7519"}">VGV7519</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Arcadyan "}" height="22" style="height:22px;">Arcadyan</td>
<td data-sheets-value="{"1":2,"2":"VRV9518"}">VRV9518</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"ASMAX"}" height="22" style="height:22px;">ASMAX</td>
<td data-sheets-value="{"1":2,"2":"BBR-4MG / SMC7908 ADSL"}">BBR-4MG / SMC7908 ADSL</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"ASUS "}" height="22" style="height:22px;">ASUS</td>
<td data-sheets-value="{"1":2,"2":"DSL-AC88U (Arc VRV9517)"}">DSL-AC88U (Arc VRV9517)</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"ASUS "}" height="22" style="height:22px;">ASUS</td>
<td data-sheets-value="{"1":2,"2":"DSL-AC87VG (Arc VRV9510)"}">DSL-AC87VG (Arc VRV9510)</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"ASUS "}" height="22" style="height:22px;">ASUS</td>
<td data-sheets-value="{"1":2,"2":"DSL-AC3100"}">DSL-AC3100</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"ASUS "}" height="22" style="height:22px;">ASUS</td>
<td data-sheets-value="{"1":2,"2":"DSL-AC68VG"}">DSL-AC68VG</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Beeline"}" height="22" style="height:22px;">Beeline</td>
<td data-sheets-value="{"1":2,"2":"Smart Box Flash"}">Smart Box Flash</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"British Telecom"}" height="22" style="height:22px;">British Telecom</td>
<td data-sheets-value="{"1":2,"2":"WE410443-SA"}">WE410443-SA</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Buffalo"}" height="22" style="height:22px;">Buffalo</td>
<td data-sheets-value="{"1":2,"2":"WSR-2533DHPL2"}">WSR-2533DHPL2</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Buffalo"}" height="22" style="height:22px;">Buffalo</td>
<td data-sheets-value="{"1":2,"2":"WSR-2533DHP3"}">WSR-2533DHP3</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Buffalo"}" height="22" style="height:22px;">Buffalo</td>
<td data-sheets-value="{"1":2,"2":"BBR-4HG"}">BBR-4HG</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Buffalo"}" height="22" style="height:22px;">Buffalo</td>
<td data-sheets-value="{"1":2,"2":"BBR-4MG"}">BBR-4MG</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Buffalo"}" height="22" style="height:22px;">Buffalo</td>
<td data-sheets-value="{"1":2,"2":"WSR-3200AX4S"}">WSR-3200AX4S</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Buffalo"}" height="22" style="height:22px;">Buffalo</td>
<td data-sheets-value="{"1":2,"2":"WSR-1166DHP2"}">WSR-1166DHP2</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Buffalo"}" height="22" style="height:22px;">Buffalo</td>
<td data-sheets-value="{"1":2,"2":"WXR-5700AX7S"}">WXR-5700AX7S</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Deutsche Telekom"}" height="22" style="height:22px;">Deutsche Telekom</td>
<td data-sheets-value="{"1":2,"2":"Speedport Smart 3"}">Speedport Smart 3</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"HughesNet"}" height="22" style="height:22px;">HughesNet</td>
<td data-sheets-value="{"1":2,"2":"HT2000W"}">HT2000W</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"KPN"}" height="22" style="height:22px;">KPN</td>
<td data-sheets-value="{"1":2,"2":"ExperiaBox V10A (Arcadyan VRV9517)"}">ExperiaBox V10A (Arcadyan VRV9517)</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"KPN"}" height="22" style="height:22px;">KPN</td>
<td data-sheets-value="{"1":2,"2":"VGV7519"}">VGV7519</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"O2"}" height="22" style="height:22px;">O2</td>
<td data-sheets-value="{"1":2,"2":"HomeBox 6441"}">HomeBox 6441</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Orange"}" height="22" style="height:22px;">Orange</td>
<td data-sheets-value="{"1":2,"2":"LiveBox Fibra (PRV3399)"}">LiveBox Fibra (PRV3399)</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Skinny"}" height="22" style="height:22px;">Skinny</td>
<td data-sheets-value="{"1":2,"2":"Smart Modem (Arcadyan VRV9517)"}">Smart Modem (Arcadyan VRV9517)</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"SparkNZ"}" height="22" style="height:22px;">SparkNZ</td>
<td data-sheets-value="{"1":2,"2":"Smart Modem (Arcadyan VRV9517)"}">Smart Modem (Arcadyan VRV9517)</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Telecom (Argentina)"}" height="22" style="height:22px;">Telecom (Argentina)</td>
<td data-sheets-value="{"1":2,"2":"Arcadyan VRV9518VAC23-A-OS-AM"}">Arcadyan VRV9518VAC23-A-OS-AM</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"TelMex"}" height="22" style="height:22px;">TelMex</td>
<td data-sheets-value="{"1":2,"2":"PRV33AC"}">PRV33AC</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"TelMex"}" height="22" style="height:22px;">TelMex</td>
<td data-sheets-value="{"1":2,"2":"VRV7006"}">VRV7006</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Telstra"}" height="22" style="height:22px;">Telstra</td>
<td data-sheets-value="{"1":2,"2":"Smart Modem Gen 2 (LH1000)"}">Smart Modem Gen 2 (LH1000)</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Telus"}" height="22" style="height:22px;">Telus</td>
<td data-sheets-value="{"1":2,"2":"WiFi Hub (PRV65B444A-S-TS)"}">WiFi Hub (PRV65B444A-S-TS)</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Telus"}" height="22" style="height:22px;">Telus</td>
<td data-sheets-value="{"1":2,"2":"NH20A"}">NH20A</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Verizon"}" height="22" style="height:22px;">Verizon</td>
<td data-sheets-value="{"1":2,"2":"Fios G3100"}">Fios G3100</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Vodafone"}" height="22" style="height:22px;">Vodafone</td>
<td data-sheets-value="{"1":2,"2":"EasyBox 904"}">EasyBox 904</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Vodafone"}" height="22" style="height:22px;">Vodafone</td>
<td data-sheets-value="{"1":2,"2":"EasyBox 903"}">EasyBox 903</td>
</tr><tr height="22"><td data-sheets-value="{"1":2,"2":"Vodafone"}" height="22" style="height:22px;">Vodafone</td>
<td data-sheets-value="{"1":2,"2":"EasyBox 802"}">EasyBox 802</td>
</tr></tbody></table><p>事隔3天，<a href="https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild">資安業者Juniper於8月6日提出警告</a>，表示攻擊者已經鎖定CVE-2021–20090漏洞，透過位於中國湖北省武漢市的IP位址，利用程式碼（Script）來發動Mirai變種殭屍病毒攻擊，其程式碼檔案的名稱，<a href="https://www.ithome.com.tw/news/143288">與3月Palo Alto Networks揭露的攻擊行動中</a>，所出現的程式碼相似。由於兩起攻擊行動的時間點相當接近，Juniper研判，兩起攻擊行動很可能是由相同的駭客所為。</p>
<p>針對此起攻擊行動，Juniper亦公布攻擊來源IP位址、程式碼檔案的雜湊值等入侵指標（IOC），以供企業偵測是否遭到入侵的跡象。</p>
</div></div></div>
