Exploiting zero days in abandoned hardware
Summary: Trail of Bits researchers fully exploited two discontinued network devices, a Netgear WGR614v9 router and a Bitdefender Box V1, at DistrictCon's inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique. Against the Netgear router they chained UPnP daemon flaws including authentication bypass, buffer overflows, and command injection for a remote root shell, and against the Bitdefender Box they combined an unauthenticated LAN-side firmware downgrade with command injection in firmware validation, also reaching a remote root shell.
Key Takeaway: The Bitdefender Box was a security appliance meant to protect home networks, discontinued in July 2021, and its signed firmware updates could still be rolled back to an old vulnerable version recovered from an APK on VirusTotal - so signature checks alone did not stop the attack. Any end-of-life device on your network is frozen at its last patch, and the researchers reached full root access on both targets from the local network.
Read the original at Trail of Bits Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026