Freshly disclosed vulnerability CVE-2021-20090 exploited in the wild | Hacker News Reader

Freshly disclosed vulnerability CVE-2021-20090 exploited in the wild

blogs.juniper.net

58 pointsafrcnc10 comments

I wish the headlines would be a bit more specific - ie, wireless router authentication bypass.

The other key piece, is this bypass available from the internet generally or just from LAN side. That's a key difference, and not clear - I've found when they say remote unauthenticated attacker often these vulns are NOT available WAN side.

So you often end up with a better headline of wireless router vulnerable to LAN side authentication bypass.

I haven't looked at this one.

But CVE as a headline is not that useful -> get past overbroad statements -> you might get to a more useful one sentance headline (these articles sometimes require reading 300+ words to even get a sense of what risk actually is - it's the new style).

It depends on the model/Vendor. There were upwards of ~15k devices showing their web interface WAN side and it could be that it is enabled by default in some cases.

You're right that the risk is dropped significantly if the web ui isn't showing WAN side (though could still be an issue for businesses using the router for public wifi, or in shared residences, etc).

From the article:

> As of August 5, we have identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in _Wuhan, Hubei province, China_.

It would be some next-level cyber trolling if the attacks were deploying some kind of a virus.

COVID-20 or COVID-19-rev-B would be great names for that.

> As of August 5, we have identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in Wuhan, Hubei province, China

Oh the irony

Eh, Wuhan has over 11 million people in it. It's much bigger than any US city, and almost all US states. A lot of stuff is going to come from there, especially shady network traffic. The city has also been there for 3.5 thousand years, so a lot has come from there historically as well.

I think this is one of those things where you hear about a type of car or something, then you start seeing it everywhere. They've always been there, but just never triggered those recognition circuits until they were primed to.

Good point

There's another post on the front page that's somewhat relevant to this: https://news.ycombinator.com/item?id=28105100.

I've seen dozens of command injection bugs in router firmware, it's terrible how we never learn.

The article mentions the IP "27.22.80[.]19". What does the [] mean?

Nothing, it's to avoid having the offending IP in plain text in the web page.

Reply on news.ycombinator.com