2 min read

Multiple Vulnerabilities in Belkin WeMo Insight Switch

Bitdefender

December 11, 2019

Ad One product to protect all your devices, without slowing them down.
Free 90-day trial
Multiple Vulnerabilities in Belkin WeMo Insight Switch

Internet of Things devices have become commonplace in modern homes. Relatively inexpensive and easy to control remotely, they promise a world at your fingertips. Security vulnerabilities in connected devices can not only affect the user experience but can also give cyber-criminals an open door to your local network. This is also the case with the Belkin WeMo Insight Switch, a smart power plug that lets you turn any conventional device into a smart one.

This article – part of a series developed in partnership with PCMag – aims to shed light on the security of the world’s best-sellers in the IoT space. PCMag contacted the research team at Bitdefender and asked us to look at several popular devices, including the Belkin WeMo Switch.  More information is available in this article published on PCMag.

Notes:

In the spirit of responsible disclosure, this whitepaper has been published after the release and adoption of a patch to mitigate the described issues. A new firmware version has been made available for affected customers. More information on how to update is available in this support article on the Belkin website.

This attack is local – in order to exploit the vulnerabilities, an attacker would already need presence inside the device’s network. While this limits exploitation, there are several circumstances where a threat actor would legitimately be able to join the local network (coffee shops, hotels, co-working spaces).”

Vulnerabilities at a glance

While investigating the Belkin WeMo Insight Switch, Bitdefender researchers have identified two vulnerabilities that can allow an attacker on the local network to obtain code execution on the device, as well as to gain root access to the filesystem, provided that they have physical access to the unit. These vulnerabilities are summarized in CVE-2019-17094.

The new Belkin WeMo vulnerability can allow an attacker on the local network to obtain remote code execution on the device. This  could potentially have a significant impact on the users’ devices connected to the local network.

Impact

A determined attacker could use the remote code execution vulnerability to plant a backdoor and remotely sniff the connection, map the consumer behavior or see when people are at home or not. Given the fact that IoT devices are not checked by conventional anti-malware solution, an affected owner would be unable to notice that the device had been compromised.

More information is available in the technical whitepaper below:

Download the whitepaper

tags


Author



Right now

Top posts

Vulnerabilities Identified in Wyze Cam IoT Device

Vulnerabilities Identified in Wyze Cam IoT Device

March 29, 2022

1 min read
New FluBot and TeaBot Global Malware Campaigns Discovered

New FluBot and TeaBot Global Malware Campaigns Discovered

January 26, 2022

10 min read
Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately

Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately

December 10, 2021

2 min read
Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand

Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand

November 08, 2021

2 min read
Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware

Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware

September 16, 2021

2 min read
LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

July 21, 2021

9 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

New FluBot Campaign Sweeps through Europe Targeting Android and iOS Users Alike New FluBot Campaign Sweeps through Europe Targeting Android and iOS Users Alike
Filip TRUȚĂRăzvan GOSAAdrian Mihai GOZOB
4 min read
New FluBot and TeaBot Global Malware Campaigns Discovered New FluBot and TeaBot Global Malware Campaigns Discovered
Bitdefender

January 26, 2022

10 min read
Poking Holes in Crypto-Wallets: A Short Analysis of BHUNT Stealer Poking Holes in Crypto-Wallets: A Short Analysis of BHUNT Stealer
Bitdefender

January 19, 2022

2 min read