Home Router Security Report - Fraunhofer FKIE (2020)
This report analyses 127 current routers for private use developed by seven different large vendors selling their products in Europe. An automated approach was used to check the router’s most recent firmware versions for five security related aspects.
We were able to extract completely 117 of the 127 firmware images. Four firmware images could be extracted partly and six firmware images could not be extracted at all. 116 of 127(91%) devices are powered by Linux. One was powered by ThreadX and another one by eCos. The security aspects addressed in this report are:
- When were the devices updated last time?
- Which operating system versions are used and how many known critical vulnerabilities affect these operating system versions?
- Which exploit mitigation techniques do the vendors use? How often do they activate these techniques?
- Do the firmware images contain private cryptographic key material?
- Are there any hard-coded login credentials?
Our results are alarming. There is no router without flaws. 46 routers did not get any security up-date within the last year. Many routers are affected by hundreds of known vulnerabilities. Even ifthe routers got recent updates, many of these known vulnerabilities were not fixed. What makes matters even worse is that exploit mitigation techniques are used rarely. Some routers have easy crackable or even well known passwords that cannot be changed by the user. Most firmware images provide private crypto graphic key material. This means, whatever they try to secure with a public-private crypto mechanism is not secure at all.
Nonetheless, vendors seem to prioritize security differently. Especially AVM does a better job than the other vendors regarding most of the security aspects. However, AVM routers are not flawless as well. ASUS and Netgear do a better job on some aspects than D-Link, Linksys, TP-Linkand Zyxel.
To sum it up, much more effort is needed to make home routers as secure as current desktop or server systems.
Additionally, our evaluation showed that large scale automated security analysis of embedded devices is possible today. We used the the Firmware Analysis and Comparison Tool (FACT)1andit worked very well for almost all firmware images analyzed during this study. FACT is an open source software available on GitHub
https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/HomeRouter/HomeRouterSecurity_2020_Bericht.pdf 
