Trend Micro home network security flaws could let hackers take over PCs
All-in-one home security device could allow code execution, DoS, and file permission changes
Researchers have discovered bugs in Trend Micro's Home Network Security Station that could let threat actors mount denial of service (DoS) attacks, escalate privileges, and execute code.
According to researchers at Cisco Talos, three security vulnerabilities in the product are labeled CVE-2021-32457, CVE-2021-32458, and CVE-2021-32459.
Trend Micro's Home Network Security Station is a device that plugs into a home router to prevent internet-connected devices from being hacked. Unfortunately, the bugs mean that the device itself can be hacked.
The first two flaws, CVE-2021-32457, CVE-2021-32458, lead to privilege escalation. The former bug exists in the tdts.ko chrdev_ioctl_handle functionality of the product. A specially crafted ioctl can lead to increased privileges. An attacker can issue an ioctl to trigger this vulnerability, causing a kernel panic leading to DoS and leveraging privilege escalation.
The latter flaw is caused by the lack of input validation on a user's ioctl request. The stack-based buffer is smaller than the maximum ioctl request copy size of 0x3FFF and thus overflows. A user can carefully craft input to gain control over a PC due to this copy.
The CVE-2021-32459 flaw is a hard-coded password vulnerability in the SFTP Log Collection Server function of Trend Micro Inc.'s Home Network Security 6.1.567. A specially crafted network request can lead to arbitrary authentication. An attacker can send an unauthenticated message to trigger this vulnerability.
From there, a hacker could create files, change permissions on files and upload arbitrary data to an SFTP server.
RELATED RESOURCE
The secure cloud configuration imperative
The central role of cloud security posture management
"The log server is utilized to dump all information that the device collects back to Trend Micro's infrastructure and can include identifiable information of the networks that the data originated from. The username and password are hard-coded in the core binary of the HNS device as diamond:bahV6AtJqZt4K. On the SFTP server, these credentials can be used to create files, change permissions on files and upload arbitrary data to the server. This could result in the loss of the logs if files are overwritten, or data exfiltration could occur if it is possible to download data," the advisory warned.
Cisco Talos said it worked with Trend Micro to address these security issues. Trend Micro has released an update for affected customers. The researchers didn't observe active attacks on these flaws.
-
Are small language models finally having their moment?In-depth The smallest AI models can be run on a mobile phone or laptop – what's the business potential?
-
‘Reducing reliance on foreign tech infrastructure is key’ to European tech success – and its long-term survivalNews MEPs have once again called for decreased reliance on foreign tech infrastructure
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
Two Fortinet vulnerabilities are being exploited in the wild – patch nowNews Arctic Wolf and Rapid7 said security teams should act immediately to mitigate the Fortinet vulnerabilities
-
Everything you need to know about Google and Apple’s emergency zero-day patchesNews A serious zero-day bug was spotted in Chrome systems that impacts Apple users too, forcing both companies to issue emergency patches
