With reference to WikiLeaks new revelations on CIA firmware CherryBlossom that has been infecting Wi-Fi routers for years. How does an attacker manage to inject an unsigned firmware without being connected to the wifi?
It is feasible for an attacker if the wifi security is open. He just needs to know the known vulnerabilities in the router's firmware. But what if the wi-fi is protected? You first need to break the wi-fi password and then bypass its router's administrative password.
The wireless device itself is compromized by implanting a customized CherryBlossom firmware on it; some devices allow upgrading their firmware over a wireless link, so no physical access to the device is necessary for a successful infection. Once the new firmware on the device is flashed, the router or access point will become a so-called FlyTrap Wikileaks says
Do vendors even sign their firmware before flashing it so that only signed firmware updates can be flashed? In this way if an attacker tries to inject its own signed firmware, that will be discarded due to incorrect signature.
Sources: https://wikileaks.org/vault7/#CherryBlossom
http://securityaffairs.co/wordpress/60095/uncategorized/cia-cherry-blossom-framework.html