Broadcom Router Information Disclosure Scanner

Broadcom routers are widely deployed in residential and corporate networks to manage internet connectivity and local traffic. Network administrators and IT professionals rely on these devices for reliable data routing and network segmentation. Internet service providers often bundle Broadcom routers with their services due to their robust performance and advanced features. Home users benefit from intuitive interfaces for managing Wi-Fi and connected devices. The routers handle critical tasks like DHCP, DNS, and firewall policies, making them central to network operations.

An information disclosure vulnerability arises when sensitive data is inadvertently exposed to unauthorized parties. In Broadcom routers, this occurs due to insecure default configurations or improper access controls on backup files. Attackers can exploit this by accessing unprotected endpoints that serve configuration backups without authentication. The vulnerability stems from the router's web interface exposing backup files in a publicly accessible directory, often without encryption or access restrictions.

Specifically, the vulnerability targets the /backup or /config-backup endpoint on the router's administrative interface. By sending a simple HTTP GET request to this endpoint, an attacker can retrieve a file containing the router's full configuration, including admin credentials, SSID keys, and VPN settings. The backup file is typically stored in plaintext or weakly encrypted format, making it trivial to parse. No authentication or session token is required to access this endpoint, leaving it open to anyone on the network.

If exploited, an attacker gains complete visibility into the router's configuration, enabling them to extract Wi-Fi passwords, admin login credentials, and network topology details. This can lead to unauthorized network access, data interception, and further lateral movement within the organization. For home users, it compromises personal privacy and device control. The CVSS score of 7.8 reflects the high impact and ease of exploitation, as no special privileges or user interaction are needed.