|Release date||Update and security topic|
There are currently a number of media reports regarding "Spectra", a vulnerability in Wi-Fi and Bluetooth chips. AVM products are not affected by the Spectra vulnerability.
In addition, media outlets are currently reporting on another Wi-Fi vulnerability called "Kr00k" (CVE-2020-3702). Common FRITZ!Box models including the 7590, 7580, 7530, 6590 Cable, 6591 Cable and 6660 Cable are essentially not affected by the Kr00k vulnerability. Other FRITZ! products with FRITZ!OS 7.20 or later are also not affected. All products for which the Protected Management Frames (PMF) feature is activated are also not affected. The PMF feature can be activated in the FRITZ!Box user interface under Wireless / Security / Additional Security Settings. AVM estimates the practical impact of the vulnerability to be low, as it did in February with Kr00k (CVE-2019-15126). The majority of Internet communication is encrypted and an attacker would have to be locally on site to exploit the vulnerability.
Callstranger - FRITZ!Box not affected
There are currently reports of a security vulnerability involving the keyword "Callstranger." Security researchers have found a way to send an amplified amount of traffic using the UPnP protocol. FRITZ!Box is not affected as its UPnP service cannot be accessed or used from the Internet.
Kr00K - FRITZ! products not affected
Media outlets have been reporting on the Kr00K Wi-Fi vulnerability (CVE-2019-15126). It only affects devices with Broadcom and Cypress chips, both of which are not used in FRITZ! products. Testing is being carried out for two older models from individual providers for special connections such as g.fast and channel bonding. If necessary, an update will be released in the near term for the two specialist models. According to the international CVSS standard, the vulnerability has a score of 3.1, which is low.
The relevance of the breach in practice is very small, as there are a number of conditions necessary for an attack to be successful, such as physical proximity to the respective device. Regardless of this, encryptions such as HTTPS are generally not affected as they operate at a higher level.
Router security - "pppd" project
Media outlets are currently reporting on the CVE-2020-8597 vulnerability in the PPP daemon (pppd) project. AVM does not use this software project and AVM products are therefore not affected by the vulnerability.
Router security – "Cable Haunt"
Media outlets are currently reporting on a vulnerability that impacts cable modems. FRITZ!Box products are not affected by "Cable Haunt". The vulnerable component does not exist in FRITZ!OS.
Wireless Security - WPA3 "Dragonblood"
Media outlets have reported on a vulnerability in the new WPA3 security protocol for devices such as smartphones, tablets, routers etc. The FRITZ!Box is not affected by this vulnerability. The recently announced FRITZ!Repeater 3000 is the only AVM product that already supports WPA3. The new WPA3 WiFi standard is not active in the repeater's factory settings.
AVM has already released an update for the FRITZ!Repeater 3000 as a Lab version, which addresses the points of the current WPA3 vulnerability. AVM also recommends always choosing a really long, strong network password. The password evaluation in FRITZ!OS helps you find a strong password. AVM strongly recommends deploying the provided updates from manufacturers for all wireless clients, for example notebooks, smart TVs or tablets.
The practical impact of the WPA3 vulnerability is considered to be low due to it still being new and less widespread than other WPA standards. The current standard used by most wireless devices is WPA2. It has proven itself over many years in the use of long, strong passwords.
Wireless security and WPA2
Media reports are currently discussing a potential attack on the WPA2 security protocol. AVM doesn't see any practical implications on the FRITZ!Box if the network key is correspondingly complex. AVM recommends using a network key that the FRITZ!Box recognizes as "good" or "strong". Due to its length, the network key that is preset upon delivery is also secure.
Malware VPNFilter - AVM products not affected
VPNFilter is a malware infecting routers around the world, and is a global issue that has been getting a lot of attention in the media. There is no evidence that AVM products are affected.
Meltdown and Spectre – no potential attacks on AVM products
Security leak in TLS negotiation (Robotattack) - FRITZ!Box not affected
Media have reported about security breaches in various TLS implementations (CVE-2017-1000385).
Krack breach in WPA2 (updated 10.11.2017)
All AVM products that are solely used as wireless access points are not affected, for example FRITZ!Boxes on broadband connections (DSL, cable, WAN, etc.). AVM products that are used as wireless LAN clients are affected by some of the indicated possibilities.
FRITZ!WLAN Repeater used as a wireless bridge (preconfigured and common operating mode): upcoming update recommended
FRITZ!Powerline supporting WiFi used as a powerline bridge (powerline uplink) (preconfigured and common operating mode): no update necessary
The security of the wireless home network depends on the secure connection of each wireless device included. Based on the internationally used CVSS classification, the WPA2 weakness was rated at 5.4 (medium) and is therefore considered a minor problem. AVM strongly recommends to deploy the provided updates from manufacturers for all wireless LAN clients (for example notebook or Android smartphone)
Report from 16.10.2017
If necessary, AVM will provide an update as always. Please find the statement from the Wi-Fi Alliance > here.
Security leaks in DNS server software Dnsmasq - FRITZ!Box not affected
Media outlets reported about several security leaks in the DNS server software Dnsmasq.
FRITZ!Box is not affected, since AVM does not use the Dnsmasq software in FRITZ!OS.
Information on home network devices under IPv6
After visiting a malicious website for a longer period it could be possible – under very unlikely circumstances – that information about home network devices (only device name, Mac and IP address) are visible when using devices with an activated IPv6 connection. Access is not possible. The risk is very low (CVSS v3: 3.1, low). This point will be fixed in the upcoming versions.
FRITZ!OS 6.83 increases robustness
The current version FRITZ!OS 6.83 fixes a weakness of the outdated FRITZ!OS version 6.80/6.81. Under certain circumstances a restart could have occurred. No misuse was reported. The version 6.80/6.81 was already completely replaced by the version 6.83 via auto update.
Attacks on the Deutsche Telekom network - FRITZ!Box secure
Media outlets have reported about a worldwide hacker attack on Internet routers. In Germany, this lead to disruptions in Speedport routers from the Deutsche Telekom.
FRITZ!Box models are not affected by the attacks.
Certificate exchange for cable routers
In the course of a certificate exchange, AVM has been using new and improved manufacturer certificates since 2015. Older certificates were exchanged by software updates from cable providers. Users don't have to do anything. Misuse of older certificates was not reported.
Dirty Cow in Linux - FRITZ!Box not affected
The FRITZ!Box perfectly secure due to regular security updates. Concerning CVE-2016-5195 (Dirty Cow), we currently see no affect on the security level of the FRITZ!Box firmware.
Telephone fraud with routers
Recently there have been a few cases of fraudulent use of telephone services connecting through routers. Concerning the FRITZ!Box, this can only be done through rarely used configurations and mostly occurs in combination with older FRITZ!OS versions at this point. AVM is continuously increasing the features and security standards of the FRITZ!Box and generally advises the use of the latest version, right now being FRITZ!OS 6.50 or higher. The current version can be checked and updated over the user interface.
The latest update for FRITZ!Box cable models is supplied by the cable providers.
You can find additional security tips in the Guide section.
DROWN attacks, SSLv2: avm.de and myfritz.net not affected
Neither is the currently implemented SSL/TLS in the FRITZ!Box.
SSLv2 was only used for an externally hosted server that was responsible for a rarely visited subdomain of avm.de until recently. This was fixed the same day the DROWN possibility was released.
Infrastructure leak in cable network and cable modem – FRITZ!Box not affected
Media outlets have reported about a security leak in the infrastructure of cable networks as well as in cable modems. Through the leak it was possible to download profiles and passwords of modems from other customers.
FRITZ!Box is not affected by this security breach.
According to statements from Vodafone/Kabel Deutschland the leak has been closed by protection filters uploaded in mid December.
Security breach through NetUSB – FRITZ!Box not affected
Media outlets are now reporting about a vulnerable service that is being used to execute arbitrary code on the router. The reports concern the service "USB Over IP", which routers use to access devices like USB printers in the local network. The driver that has been compromised is called NetUSB.
The FRITZ!Box is not affected by the exploited security flaw, as it never uses the NetUSB driver.
FRITZ!Box products, both hard and software, are all developed in house by AVM. Regular, free updates to the FRITZ!OS operating system are integral to the FRITZ!Box concept and keep all devices up to date with the current state of technology.
Security breach through Rompager – FRITZ! products not affected
At the recent 31. Chaos Communication Congress, it was announced that the HTTP server Rompager showed multiple security leaks. FRITZ! products are not affected by this.
The HTTP server Rompager is a software used on many routers from other manufacturers to provide certain protocols. Among others, the security breach allows strangers to take over administration rights on affected routers. Please find more information on this topic and a list of affected devices under this link.
Reporting security topics
Do you have suggestions about how to improve the security of our products? Then please contact us at firstname.lastname@example.org. We will get back to you via email should we have follow-up questions. Apart from that, please excuse that you will not get an individualized reply. For safe transmission of sensitive data, we advise you to encrypt emails to email@example.com using the PGP Key by AVM.
Should you require assistance concerning technical questions, our Support Desk will be glad to assist you.
Please consider our security information about updates as well.