The Misfortune Cookie critical Vulnerability can affect millions of home routers

Posted: December 24, 2014 in Vulnerability News
Tags: , ,

Vulnerabilities 2014The flaw allows a remote user to gain full control over the router and attack all devices connected to the home network.

The company Check Point Software Technologies has found a critical vulnerability Misfortune Cookie, which able to hit tens of millions of home routers worldwide (mostly residential gateways / SOHO – small office/home office routers). The CVE-2014-9222 flaw allows attackers to gain control of network devices, and administrative privileges, and then carry out an attack on all devices in the home network.

The vulnerability is caused due to an error in the mechanism of control cookie-files in the HTTP protocol (port 80 access not required! many devices listen publicly on port 7547 to receive instructions from ISPs). This can be exploited via a specially crafted cookie-file cause memory corruption and gain administrative privileges and full control over the device.

The flaw affects more than 200 models of routers from D-Link, Edimax, Huawei, TP-Link, ZTE, ZyXEL and other manufacturers (The full list is posted online at At the time of the study, experts found at least 12 million vulnerable network devices worldwide. Researchers believe that the vulnerability is caused by an error in the embedded web-server RomPager from AllegroSoft.

AllegroSoft fixed this hole in 2005, but the manufacturers of routers in most cases did not included a correction in the updated versions of firmware. Researchers recommend that you connect the firewall or use a vulnerable device as a bridge between the home network and secure router that receives signals from the Internet. Advanced users can install modified versions of firmware with built-in correction.

Check Point LogoSource:


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s