AVG Network Inspector alert: ShellShock vulnerability found

This article explains how to resolve the issue if Network Inspector in AVG AntiVirus shows the following alert:

• ShellShock vulnerability found

If you see the alert above after running a Network Inspector scan, your router contains a serious vulnerability that could allow an attacker to take control of your network. This makes all of the devices connected to your network vulnerable.

Solution

We recommend trying the possible solutions below in order:

• Disable remote admin for your router
• Update your router's firmware

Disable remote admin for your router

You can minimize the risks linked with this vulnerability by ensuring that the remote administration option in your router settings is disabled.

For instructions, refer to the Disable remote admin tab in the following article:

• AVG Network Inspector alert: Device is accessible from the internet

It is also necessary to update your router's firmware.

Update your router's firmware

Newer versions of your router's firmware may contain a fix for this issue. Routers do not typically run updates automatically, so you need to manually download and install any available updates.

Consult the documentation for your router model for instructions on how to download and install firmware updates. If updated firmware is not available, contact the manufacturer of your router to request that they provide a firmware update as soon as possible.

If you are unable to install a firmware update, we recommend replacing your router.

Further details

Your router contains the Shellshock Bash vulnerability.

The affected router is running an unpatched version of the Bash shell program. This potentially allows a remote attacker to gain control of your router and your internet connection by utilizing specially crafted environment variables to bypass your security. The attacker can then remotely execute shell commands with elevated privileges and steal private data that is stored on your router, including your login credentials, Wi-Fi password, and configuration data.

Any devices that are connected to your network, including computers, phones, tablets, printers, and security cameras, are at risk.

You can find more information about this vulnerability via the reference below:

• CVE-2014-7169