If your router's range can't cover your whole house, it's likely you're using a Wi-Fi extender. If you're using one from TP-Link though, it turns out that security researched from IBM have found a critical vulnerability with the the popular router company which allows potential attackets to get control of the extender. This could be used to redirect the victim's traffic and lead people to malware, IBM said in a blog post on Tuesday.
The extenders affected by the vulnerability included the RE365, the RE650, the RE350 and RE500, IBM said. The flaw was discovered by Grzegorz Wypych, an IBM X-Force researcher. However, IBM said TP-Link has released updates for affected users.
It turns out that potential attacker doesn't need to be within the extender's Wi-Fi range to exploit the vulnerability, Limor Kessem, IBM X-Force's global executive security adviser, said in an email to CNET.
The attack works by sending a malicious HTTP request to the Wi-Fi extender. The vulnerability on TP-Link's Wi-Fi extender allows a potential attack to execute commands from the request. This access is normally limited, IBM explained. Although the attacker would need to know the extender's IP address to exploit the vulnerability, you can actually find thousands of exposed devices on IoT search engines like Shodan.
Potential attacks include redirecting people to pages with malware, as well as taking over the routers to use as part of a botnet.
"Bear in mind that this level of privilege could allow potential attackers to carry out more sophisticated malicious activity by executing any shell command on the device's operating system," said Kessem.