Is Your Biggest Cyber Vulnerability Your Router?

Is Your Biggest Cyber Vulnerability Your Router?

TheBestVPN found vulnerabilities in several big name routers.

Internet routers could be affected by a major security flaw that could let hackers infiltrate your home network.

Research from TheBestVPN found vulnerabilities in routers from some of the biggest device manufacturers around today, including those from NetGear, D-Link and ZTE.

The research team found that all three contained software flaws that could allow malicious access, which TheBestVPN says could result in, "a complete takeover of your router".

The team says that the hack process is relatively straightforward, with the criminals simply needing to create a page with a basic JavaScript or html form. When a user clicks on this or lands on the webpage, external functionalities can be launched, allowing personal data can be exploited.

Craig Young, a computer security researcher for Tripwire’s Vulnerability and Exposure Research Team (VERT), says TheBestVPN is describing a multiple cross-site request forgery (CSRF) attack.

"The premise of CSRF is that an attacker can trigger a victim’s web browser to make HTTP requests to another web site without the target site recognizing that the request was forged," Young said. "In this case, the targeted web site would most likely be the web page for controlling router settings, but it could also be a server used for media streaming or file sharing. In most cases, a CSRF attack requires that the victim is logged into the vulnerable web site, but routers often have vulnerabilities which can be triggered by unauthenticated HTTP requests."

Since the devices are older, Young wonders if a security fix will be made available.

“A quick Google search indicates that these are all older devices which raises an interesting question of whether security fixes will be made available," Young said. "For a successful CSRF attack, the attacker needs to locate the victim’s router to relay an attack. An advanced user can thwart unsophisticated attempts to exploit these bugs by simply using a less common router address like instead of A more complete fix however would be to actively disable the HTTP management interface of the router so that it cannot be attacked.”

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

  • Securing Entertainment Venues Securing Entertainment Venues

    One thing entertainment venues, sports stadiums and theme park officials want to accomplish is getting people back into their seats. That is happening today—but not without understanding and technology. In this episode, AJ DeRosa shares his insight on how COVID-impacted businesses are able to face safety and security issues with confidence and technology. We also discuss visitor expectations and how venue officials can ensure their space is secure as they welcome visitors back.

Digital Edition

  • Security Today Magazine - November December 2021

    November / December 2021


    • Navigating System Integration
    • Protecting Premises and People
    • Cashing in Your VMS System
    • Encryption and Compliance
    • Security Breach at 38,000 Feet

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety