4

I have had two Linksys EA4350 Routers for a week or so being used internal my network as wireless access points, and all of a sudden I started noticing requests from them once per minute (care of my apache logs) but network traffic indicates requests every 5 seconds.

192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET / HTTP/1.1" 302 - "-" "-" 
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /HNAP1/ HTTP/1.1" 404 2989 "-" "-" 
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "POST /JNAP/ HTTP/1.1" 404 2987 "-" "-" 
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /rest/login?next=/ HTTP/1.1" 301 - "-" "-" 
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /rest/login/?next=/ HTTP/1.1" 200 3634 "-" "-"

The last two "/rest/login" are actually my server redirecting the first request "GET /" to my login screen, since / is the only valid URL in my web server (Hence 302 instead of 404).

Where 192.168.1.x is the IP of my Linksys router, and all traffic is on port 80 (not 8080). I have tried rebooting both of them at the same down, updating the firmware to 1.0.3.160602, and putting them in bridge mode to disable "most" of the features. None of these have help.

NOTE: this router is not directly exposed to the internet, but can outbound access it. I suspected TheMoon worm, but too many details don't add up (Supposedly EA4200 is the last vulnerable, not directly exposed to internet, reboot didn't stop it, firmware didn't fix it, wrong port, etc...)

Should I be worried that my router is infected with something, or is this an annoyance I just need to filter out of my logs?

UPDATE: I remapped every IP on my network to an entirely different subnet (10.x.y.z), and the Traffic Continued sporadically (not once a minute, just randomly) for an additional hour AFTER the IPs changes (so it came from the router's NEW IP addresses) and then stopped and hasn't been seen for almost a week now.

Improve this question

1 Answer 1

Reset to default
1

Your router may be scanning for vulnerabilities other routers, it certainly does not appear to be expected behaviour.

  • POST /JNAP/ is likely an attempt to exploit CVE-2014-8244
  • GET /HNAP1/ is likely the vulnerability used by the moon worm
  • I wasn't able to pinpoint the rest urls to a specific vulnerability with a quick search.

According to the CERT advisory I linked to for the JNAP vulnerability you should be using a much newer version of the firmware.

Improve this answer
2
  • I forgot to specify, the rest URLs are actually mine. That is expected behavior from my server.
    – Andy
    Commented Nov 20, 2014 at 15:46
  • Given that the router was scanning EVERY IP EVERY minute, that is way too aggressive for "Linksys is just looking out for me." Furthermore, that isn't really their jurisdiction, is it? Also, I've updated that it stopped (somehow). I'm going with the EA4300 series IS vulnerable to these two attacks you've identified, and Linksys has incorrectly excluded it from their vulnerable list, and perhaps has not patched it. Ordering new routers. Thanks wireghoul for identifying the exploits.
    – Andy
    Commented Nov 26, 2014 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .