An attacker might exploit a new set of severe vulnerabilities in the Realtek RTL8170C Wi-Fi module to obtain elevated privileges on a device and hijack wireless communications. Experts from Israeli IoT security firm Vdoo said in a recent blog:
“Successful exploitation would lead to complete control of the Wi-Fi module and potential root access on the OS (such as Linux or Android) of the embedded device that uses this module”.
The vulnerabilities discovered in the Realtek RTL8710C Wi-Fi, which is in use in the automotive industry, affect all embedded and IoT devices that use the component to connect to Wi-Fi networks. Ameba, an Arduino-compatible programmable platform with peripheral ports for developing a range of IoT applications, is enabled by the Realtek RTL8710C Wi-Fi SoC.
The flaws affect all embedded devices spanning across agriculture, automotive, energy, healthcare, industrial, security, and smart home sectors that use the component to connect to Wi-Fi networks. The adversary would need to be on the same Wi-Fi network as the devices using the RTL8710C module or know the network’s pre-shared key (PSK) used to authenticate wireless clients on local area networks. The findings follow a February investigation that discovered similar flaws in the Realtek RTL8195A Wi-Fi module, featuring a buffer overflow vulnerability (CVE-2020-9395) that allows an attacker in close proximity to take complete control of the module without knowing the Wi-Fi network password.
Written by Nishat Mowla
