Virgin Media O2 router bug could leave users open to attack

Virgin Media Hub 3.0
(Image credit: Virgin Media)

Customers of Virgin Media O2 in the UK may need to up their security protections after the company was accused of still not having fixed a long-standing flaw in some of its routers.

The ISP admitted to that the issue, which affects its popular Hub 3.0 routers, is still active, affecting some customers who use a VPN to try and keep themselves safe online.

The flaw can apparently allow threat actors to access sensitive information, including a user's IP address, even if they are using a VPN.

Router issue

The issue was first spotted back in October 2019 by security researchers at Fidus, with Virgin Media (as it was known before its merger with O2) acknowledging the issue shortly after. However, the company later asked Fidus to hold back on publicly declaring any information on the issue until Q1 2021. 

Fidus says it contacted Virgin Media for updates several times, but after no reply, declared the flaw, known as CVE-2019-16651, in March 2021. 

In its declaration, Fidus went into more detail on the attack, noting that it was a DNS rebinding attack, which can be utilised to reveal a user’s actual IP address simply by visiting a webpage for a few seconds.

"During our testing, it was possible to unmask the true IP address of users across multiple popular VPN providers – resulting in complete deanonymisation," the company added.

The company did add that the attack did not appear to affect all VPN providers, only those which block access to local IP addresses by default.

In response to an email from TechRadar Pro, Virgin Media O2 said that the issue was fairly niche, and would not affect the vast majority of its customers, most of whom do not use a VPN.

“We are aware of a highly technical issue which, in very particular circumstances, could impact customers using a VPN while accessing a malicious website. A very specific set of circumstances would need to be in place for a customer to be impacted, meaning that the risk to them is very low," a Virgin Media spokesperson told TechRadar Pro.

"We have strong security measures in place to protect our network and keep our customers secure. We are not aware of any customers being affected by this issue and they do not need to take any action.”


Mike Moore
Deputy Editor, TechRadar Pro

Mike Moore is Deputy Editor at TechRadar Pro. He has worked as a B2B and B2C tech journalist for nearly a decade, including at one of the UK's leading national newspapers and fellow Future title ITProPortal, and when he's not keeping track of all the latest enterprise and workplace trends, can most likely be found watching, following or taking part in some kind of sport.