▲Unauthenticated RCE in Motorola's MR2600 Router(mrbruh.com)
56 points by MrBruh 5 hours ago | 4 comments
▲yukIttEft 2 hours ago
In Germany we have "Störerhaftung" where routerowners are responsible for everything that happens through their router.

I wonder how this would hold up in court, couldn't you argue that routers are generally buggy, how can they force any responsibility if they can easily be hacked?

▲hylaride 25 minutes ago
It would depend on the laws of the jurisdiction. I would imagine if you can show you kept the firmware up to date and had a secure as possible config (eg not having admin interfaces exposed to the internet), you could argue that there's no negligence - outside of maybe using a known insecure vendor; sometimes I think that would be a good idea (cough cough Fortinet).

Germany has some sensible laws about personal responsibility, like it being an offence to run out of gas on the autobahn and seriously treating driving in general as a privilege. But it requires a certain cultural mindset.

▲nerdsniper 2 hours ago
Nearly every stock consumer router keeps getting these RCE’s. Perhaps that’s the point, they can get any arbitrary household in trouble if it’s expedient to do so.
▲cynicalsecurity 1 hour ago
It won't work. You would need to back up your claim with proof that someone hacked your router. You can't drive a car that is easily breakable and expect the court to clear you of any responsibility if it causes harm because it broke while you were driving.
▲faidit 1 hour ago
An allegory here would be someone stealing an easily stealable car (e.g. doing the Kia Challenge) and causing damage or injury. The thief would be liable, not the owner
▲SoftTalker 6 minutes ago
Generally any damage done by a car is the responsibility of its owner. The owner will likely be sued anyway, because they have insurance and assets, and the thief (even if known) does not.
▲msh 1 hour ago
But if it’s the isp delivered router they should carry the responsibility
▲wildzzz 48 minutes ago
I would assume that liability is avoided when someone has done a reasonable effort to secure the device. The user needs to make sure they've secured their router from unauthorized access by using proper passwords. The ISP needs to make sure the router is delivered with the latest firmware and is pre-configured to be secure.
▲bri3d 2 hours ago
Vendor wise, these were never really made by a “Motorola” -this is a Zoom router (thus the domain) that used the Motorola name under license.

The “old” Motorola router division Motorola Home got sold to Arris _without_ the brand name in 2013, and then the brand name went to Zoom in 2016. Zoom merged with another vendor called Minim, went bankrupt in 2023, and the assets were bought by a company called e2Companies in 2024.

So e2Companies is who the author should email, but good luck. I’m shocked these were even “maintained” until 2024.

▲VladVladikoff 3 hours ago
>42 hosts with remote management

>vender doesn’t want to fix it

Sometimes I wonder if the white hat hackers who find such a thing should just take it a step further and patch those hosts. Take the firmware, fix those bugs and update those 42 routers.

▲nerdsniper 2 hours ago
That would be “gray hat”. It would be illegal, though it has happened in the past and to my knowledge no one has yet been prosecuted for illegally fixing vulnerabilities.

But it’s definitely not white hat.

▲mrweasel 47 minutes ago
Someone did, a Russian dude (or at least Russian speaking) updated over a 100.000 Mikrotik routers. While he did get a few "Thank you" notes, some users was also pretty angry with him.

https://www.zdnet.com/article/a-mysterious-grey-hat-is-patch...

▲CrzyLngPwd 3 hours ago
Probably simpler to brick them, forcing the owners to upgrade to a modern and supported device.
▲itintheory 2 hours ago
Isn't just as illegal as exploiting them for nefarious purposes? That's a pretty big risk to take to help a few dozen strangers on the Internet. What happens if your fix has an unforeseen interaction with some configuration on a remote system and your actions cause outage or worse?
▲binaryturtle 2 hours ago
Just flash OpenWRT to them? :) (a script could prepare a matching default config)
▲4llan 2 hours ago
Really curious the use of the "zoom.com" domain. However, since the endpoint uses insecure HTTP, maybe this should be a simple endpoint/hostname redirection.

A search of "router/firmware/query.aspx" leads me to D-Link endpoints who also uses the "wrpd" subdomain.

▲bri3d 1 hour ago
Zoom were a very longstanding modem company who expanded into cable and routers and licensed the Motorola brand in 2016.