Current security notifications

04.07.2017

Information on home network devices under IPv6

After visiting a malicious website for a longer period it could be possible – under very unlikely circumstances – that information about home network devices (only device name, Mac and IP address) are visible when using devices with an activated IPv6 connection. Access is not possible. The risk is very low (CVSS v3: 3.1, low). This point will be fixed in the upcoming versions.

19.04.2017

FRITZ!OS 6.83 increases robustness

The current version FRITZ!OS 6.83 fixes a weakness of the outdated FRITZ!OS version 6.80/6.81. Under certain circumstances a restart could have occurred. No misuse was reported. The version 6.80/6.81 was already completely replaced by the version 6.83 via auto update.

28.11.2016

Attacks on the Deutsche Telekom network - FRITZ!Box secure

Media outlets have reported about a worldwide hacker attack on Internet routers. In Germany, this lead to disruptions in Speedport routers from the Deutsche Telekom.

FRITZ!Box models are not affected by the attacks.

10.11.2016

Certificate exchange for cable routers

In the course of a certificate exchange, AVM has been using new and improved manufacturer certificates since 2015. Older certificates were exchanged by software updates from cable providers. Users don't have to do anything. Misuse of older certificates was not reported.

27.10.2016

Dirty Cow in Linux - FRITZ!Box not affected

The FRITZ!Box perfectly secure due to regular security updates. Concerning CVE-2016-5195 (Dirty Cow), we currently see no affect on the security level of the FRITZ!Box firmware.

07.06.2016

Telephone fraud with routers

Recently there have been a few cases of fraudulent use of telephone services connecting through routers. Concerning the FRITZ!Box, this can only be done through rarely used configurations and mostly occurs in combination with older FRITZ!OS versions at this point. AVM is continuously increasing the features and security standards of the FRITZ!Box and generally advises the use of the latest version, right now being FRITZ!OS 6.50 or higher. The current version can be checked and updated over the user interface.

The latest update for FRITZ!Box cable models is supplied by the cable providers.

You can find additional security tips in the Guide section.

03.03.2016

DROWN attacks, SSLv2: avm.de and myfritz.net not affected

Neither is the currently implemented SSL/TLS in the FRITZ!Box.

SSLv2 was only used for an externally hosted server that was responsible for a rarely visited subdomain of avm.de until recently. This was fixed the same day the DROWN possibility was released.

17.02.2016

Security breach through glibc in Linux network functions – FRITZ!Box not affected

Media like arstechnica.com and bbc.com have reported about a security leak in Linux networks via the glibc library.

FRITZ!Box is not affected, since AVM does not use glibc in FRITZ!OS.

23.12.2015

Infrastructure leak in cable network and cable modem – FRITZ!Box not affected

Media outlets have reported about a security leak in the infrastructure of cable networks as well as in cable modems. Through the leak it was possible to download profiles and passwords of modems from other customers.

FRITZ!Box is not affected by this security breach.

According to statements from Vodafone/Kabel Deutschland the leak has been closed by protection filters uploaded in mid December.

20.05.2015

Security breach through NetUSB – FRITZ!Box not affected

Media outlets are now reporting about a vulnerable service that is being used to execute arbitrary code on the router. The reports concern the service "USB Over IP", which routers use to access devices like USB printers in the local network. The driver that has been compromised is called NetUSB.

The FRITZ!Box is not affected by the exploited security flaw, as it never uses the NetUSB driver.

FRITZ!Box products, both hard and software, are all developed in house by AVM. Regular, free updates to the FRITZ!OS operating system are integral to the FRITZ!Box concept and keep all devices up to date with the current state of technology.

06.01.2015

Security breach through Rompager – FRITZ! products not affected

At the recent 31. Chaos Communication Congress, it was announced that the HTTP server Rompager showed multiple security leaks. FRITZ! products are not affected by this.

The HTTP server Rompager is a software used on many routers from other manufacturers to provide certain protocols. Among others, the security breach allows strangers to take over administration rights on affected routers. Please find more information on this topic and a list of affected devices under this link.