In the worst-case scenario, an attacker could target vulnerable devices on a massive scale, using a similar mechanism to how botnets like Mirai worked – by scouring the web and hijacking routers using default passwords like “Admin” and “Pass.”
TP-Link released a patch a few weeks later for the vulnerable WR940N router, but Mabbitt warned TP-Link again in January 2018 that another router, TP-Link’s WR740N, was also vulnerable to the same bug because the company reused vulnerable code between devices.
TP-Link said the vulnerability was quickly patched in both routers.
TP-Link declined to disclose how many potentially vulnerable routers it had sold, but said that the WR740N had been discontinued a year earlier in 2017.
@TechCrunch.com | 6 minutes read