Chinese telecoms kit maker Huawei has said it is investigating claims by researchers that two of its router products contain serious vulnerabilities which could allow hackers to remotely take control of the devices.
Felix Lindner and Gregor Kopf of Berlin-based Recurity Labs announced their findings at the Defcon hacking show at the weekend (via The H), claiming that the products contain 1990s-style code and no operating system hardening, leaving them vulnerable to “90s style exploitation”.
The major coding error pointed out by the duo was a heap overflow vulnerability in the software of the AR18 and AR28 products, which are designed for use by home office workers and mid-sized enterprises respectively.
Huawei also produces routers and other kit for big-name global telecoms clients, although the researchers claimed they did not have access to test these high end products.
Lindner and Kopf complained that it has been virtually impossible to responsibly disclose their findings to Huawei because there is no obvious “externally visible product security group” and because the firm doesn’t publish security advisories for any products.
However, Huawei has hit back, claiming that its Network Security Incident Response Team (NSIRT) should always be the first port of call.
Huawei has established a robust response system to address product security gaps and vulnerabilities, working with our customers to immediately develop contingency plans for all identified security risks, and to resolve any incidents in the shortest possible time. In the interests of customer security, Huawei also calls on the industry to promptly report all product security risks to the solutions provider so that the vendor’s CERT team can work with the relevant parties to develop a solution and roll-out schedule.
For the record, an incident response organisation for comms vendors and service providers called FIRST can also be contacted in the event that security researchers find vulnerabilities like the ones above.
Huawei said it is currently “verifying” the claims made by Recurity and urged any similar claims in the future be emailed first to firstname.lastname@example.org ®