Can an infected router penetrate the OS connected to it without the knowledge of the user, as Petya did?

Question

Computer networks

crazy question, I apologize for this, I just want to make sure my assumptions

. In 17, the Petya infection actively went around, which infected computers under Windows on the local network, and the infection itself occurred without the knowledge of the user at all.
Duck here. Can, in theory, an infected router in this way penetrate the OS (windows, Linux) for any purpose?
We are not talking about, for example, the substitution of DNS sites with any software, namely about “painless” penetration into the PC, when the user did not install anything, but simply connected to such a router.

it is assumed that the operating system is the current version, where previously known vulnerabilities have already been fixed long ago

Answer 1

To "penetrate the OS" it must have a vulnerability that is exploited by an attacking hacker or virus. And Petya did just that: he attacked through the EternalBlue vulnerability . And, yes, if there is a vulnerability, then a hacked (or infected with a virus) router can be used as a platform for further attacks on the local network.

it is assumed that the operating system is the current version, where previously known vulnerabilities have already been fixed long ago

With this condition, the attack is possible only through unknown vulnerabilities (zero-day).

Answer 2

Well in theory yes