CVE-2017-1000020

Name of the Vulnerable Software and Affected Versions eCos versions 1 and other versions ECos Embedded Web Servers (affected versions not specified)

Description The issue is related to a web authentication bypass in eCos Embedded Web Servers used by multiple routers and home devices. When sending SYN Flood or FIN Flood packets, the web server fails to validate and handle the packets, resulting in authentication bypass. This allows an attacker to take control of the device remotely or locally. The estimated number of potentially affected devices is not specified.

Recommendations For eCos version 1 and other affected versions, consider disabling the web server functionality until a patch is available to prevent exploitation. Restrict access to the embedded web server to minimize the risk of exploitation. Avoid using the embedded web server for authentication purposes until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.