CVE-2018-1143

This bug is like leaving the router’s “control panel keyboard” open to the internet—without a login—and letting an attacker type commands that the router treats as fully trusted (root). If someone can reach that part of the router, they could reconfigure the network or disrupt your connectivity. For a small business, that can mean loss of internet access or exposure of traffic while the router is under attacker control.

This matters if your small business uses a Belkin N750 router (including the n750 db wi-fi dual-band n+ gigabit router (f9k1103)) running the vulnerable firmware. Because the problem is unauthenticated and has been noted as reachable in the default configuration, it creates risk when the router is accessible from the network an attacker can reach (often meaning the internet or otherwise-untrusted networks). The danger is highest if the affected web endpoint can be reached without logging in.

This is urgent because attackers do not need a login to trigger the issue, and remote command execution means a compromise can be severe. The available public exploit and rising public attention increase the odds of real-world attempts. Follow up immediately on whether your router is on firmware 1.10.22 and whether it is reachable from the internet.