Description
Our scan found a vulnerability on your router. Your router contains a problem that can be misused by cybercriminals to break into your network and compromise your security and privacy.
Solution
Some of the vulnerabilities may be patched in new versions of the device firmware. Applying the latest firmware update may solve the issue. Routers typically do not perform automatic updates, so you need to manually download and install the appropriate patches on the device.
Consult your router's manual for instructions. If updated firmware is not available, contact your router's vendor or manufacturer to provide a firmware update as soon as possible.
Done incorrectly, applying the latest firmware can make your router unusable. We recommend this method for advanced users or computer technicians only.
Details
We have identified the following problem with your router:
ROM-0 backup disclosure vulnerability
Severity: High
Reference: CVE-2014-4019
Description:
This vulnerability allows a remote attacker to easily gain control of your router and Internet connection. The attacker can remotely utilize a specially crafted HTTP request to download the ROM-0 backup file from your router without being authenticated, and access all important and private data stored in the router -- your router login/password combination, your Wi-Fi password, and your configuration data.
Impact:
Any device connected to your network -- including computers, phones, tablets, printers, security cameras, or any other networked device in your home or office network -- may have an increased risk of compromise.
Recommendation:
Aside from applying the firmware update that addresses the issue, you can solve this vulnerability by configuring port forwarding for port 80 on the router to an unused IP address on your network. To do that, enter your router configuration page and find the "Port forwarding" section. Here, set up a rule that tells the router to send all http traffic to an unused local IP address (for example 192.168.0.255, if this address is not used by any other device on the network).