A number of remote code execution bugs in FRITZ!Box broadband routers could allow intruders to place phone calls through the device, according to The Register.
Attackers could also listen in on traffic and install backdoors on the devices.
The vulnerabilities exist in all firmware versions prior to 6.30 of the tool line. The devices – which can include a modem, a Wi-Fi access point, routing and VoIP – are in wide use in Germany and Australia,
"After successful exploitation, attackers gain root privileges on the attacked device," said an advisory from RedTeam Pentesting.
Attackers would need to break in by connecting directly to the service via the LAN or could gain entry via an attacker-controlled website visited by a FRITZ!Box user, the RedTeam wrote. The infected website can then use a cross-site request forgery to engage the service via a browser.
RedTeam said the vulnerability poses a high risk.
The fix, they wrote, is as usual: Upgrade the firmware.
