bk99.de entertain the web since 1997

bk99.de
HN · Router securityCurated

A hidden router interface on TCP port 32764

Summary

Eloi Vanderbeken analyses an unknown service in home routers that can read out configurations and execute arbitrary commands with root privileges. The service used TCP port 32764. Devices from several brands were affected.

Ideas

  • A proprietary service listens on a fixed TCP port.
  • Reverse engineering reconstructs the message format and the available commands.
  • The interface reads the router configuration including credentials.
  • One command starts arbitrary programs with the highest privileges.

Insights

  • Undocumented maintenance access becomes a permanent attack surface.
  • Network segmentation limits the damage done by insecure embedded devices.
  • Checking firmware needs binary analysis and runtime tests together.

Facts

  • The analysis code was published on GitHub.

Recommendations

  • Block management access from untrusted networks.
  • Replace routers that are no longer maintained or install free firmware.

References

Read the original article

Search the Web Archive

HN · 2026

Dirty Frag: a note on a Linux privilege escalation

The oss-security post describes a chained local Linux privilege escalation and its problematic disclosure before a coordinated fix. The publication contains working demonstration code for x86-64 systems. Chaining vulnerabilities makes individually limited bugs system-critical together.

HN · 2025

Oniux: Tor isolation with Linux namespaces

The Tor Project presents oniux, which starts any Linux program in isolated Tor network namespaces. oniux is Linux-specific and written in Rust. The tool combines Linux namespaces, Arti and onionmasq.

HN · 2025

Landrun: sandboxing Linux processes without root

Landrun makes Landlock rules usable as an unprivileged command line sandbox for any Linux process. Landlock file system protection has existed since Linux 5.13. TCP restrictions require at least Linux 6.7 and ABI 4.