bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Broadcom hole lets attackers knock out entire Wi-Fi networks

Summary

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

Ideas

  • A single prepared packet is enough to disrupt an access point permanently.
  • Encryption does not protect against attacks on the management level of the wireless network.
  • A Wi-Fi network that has been knocked out can be replaced by the attacker’s “evil twin”.
  • The researchers deliberately held back technical details.

Insights

  • Holes in chipset firmware only reach users if every device manufacturer passes on the patch.
  • Availability is a security goal that Wi-Fi encryption does not cover.

Facts

  • Only 5 GHz networks were affected; 2.4 GHz apparently was not.

References

Critique

  • Without details and a list of affected chips, operators can hardly assess their risk.

Recommendations

  • Keep router and access point firmware up to date and check manufacturers’ advice on Broadcom chips.
  • Additionally protect logins against evil twin phishing with HTTPS with HSTS and two-factor methods.

Read the original article

Search the Web Archive

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.

g · 2025

Partly critical router holes endanger industrial networks

In January 2025 the industrial network equipment supplier Moxa warned of two holes in routers and security appliances used, among other places, in energy facilities. CVE-2024-9138 is based on hard-coded credentials and gives authenticated attackers root privileges; the critical CVE-2024-9140 allows system commands to be injected. Firmware updates were available for several model series, while for others there were only workarounds or a referral to support.

g · 2023

Security hole in SugarCRM servers actively exploited

In early 2023 attackers exploited a critical hole in SugarCRM (CVE-2023-22952) to take over servers and install malware. Authentication could be bypassed via the path /index.php/, after which a POST request uploaded a PNG file containing PHP code that was executed when called up later. By 11 January Censys found 354 compromised servers, just under twelve percent of all 3,059 reachable instances.