First of all - DON’T PANIC

Is this an “update my router/modem” situation? Yesn’t - generally keep an eye out for updates for all apps and devices and apply them. But that’s general advice not sepcific for your router.

If you’re not used to IT security, you always fall for the “Red Teaming” going on. Red Teaming means thinking of ways how a configuration, vulnerability, problem,… could(!) be used by the bad guys to proactively up your defenses. Or “guesstimate” how bad the situation will be. And you will always assume the worst case to be prepared. This usually always sounds and feels scarier than the reality is. Look back at my post and check if what I said contains ANY reference to how hard (or costly or time consuming) it’d probably be. Then add that nowadays many vulnerabilities are marketed for attention (or to also sell security products) - often with a fancy name, logo and website.

First of all: Nothing is risk free. You can just minimize the risks. And also many mitigations are a trade off between security and usability (or another dimension like affordability of new devices): Switch the device off, pull the plug and all connections to the external world and put it in a high security safe. Now you have an almost unhackable system - that you can’t use anymore. And I’d still be able to find a (more or less unlikely) scenario how that device can get hacked…

Security usually relies on the “Swiss Cheese Model”. Every security measure has holes like a slice of cheese. You can add more layers, but in the end there might still be some area uncovered by cheese. Here, we have several factors in play:

For this attack to succeed, I need to be in a position where I’m able to route ALL your traffic (that I’m interested in) through my box. The internet routes every package on an efficient way to the target, but theres no guarantee that all packets from the transmission take the same route. So it’s not the best idea to put that box on a random point along the route. I need the whole transmisson. And then use these leaked keys to sneakily wiretap you (or alter the contents of the transmission). The two ideal positions would be the router that connects the network to the internet or the WiFi access point that you connected to. But this vulnerability (alone) should NOT be able to hack your router. You’d still need a way to get this set up on a router. One could use that to intercept the query for available updates from your router and send it a forged one, but usually those updates are also signed cryptographically and you’d need the key from it’s vendor, too. And a specific software for your specific router. That’s probably way too much work. I could also hack a server that you connect to, but then I wouldn’t need those keys as I already control the server an can send you whatever I want (or read what you send me).

Second, what applications are at risk? In theory: If they connect to the internet, they are at risk. BUT:

1. They should check at least if the cert is in some trust store. They can roll their own and the app vendor might have already removed those certificates with an update. Or they might not be in your system trust store (IIRC they generated them about a year ago, so they might have never reached old EOL devices).
2. They might employ other security measures (like “we only use certificates by Let’s Encrypt, so we mistrust all other certificates like eMudhra”)
3. Some apps/systems never trusted this CA in the first place according to some reports as it wasn’t participating in the Certificate Transparency Log

Also define “at risk”: If someone can intercept your traffic AND use this forged certificate - WHAT can they gain? To “hack” the app and from there the device itself, they need another exploit in the app and send that to you. If you’re logged in, they might be able to steal your credentials or your current session. But depending on the app - what is that worth? Your banking app probably features further security measures and is hopefully not affected. A transit app? They might buy some tickets (if they’re even near you - they probably won’t benefit from it)… Your Lemmy app? They might be able to use your credentials to access your account to send spam. But is that account worth something so that they can sell it or such?

Read: It depends on the app. And remember - it’s company/developer/server could in theory be hacked (without these leaked keys, mind you) which yould bring you into the same situation.

IMHO: Someone found it and reported it. This might have been a honest mistake by that CA. Someone might have found that before and (ab)used it. It might have been found / a ruse by a state actor/“three letter agency” to have an easy way to wiretap people secretly. You cannot tell. BUT: If it’s the latter - why would YOU specifically be targeted? And now that it’s known it won’t work anymore reliably - so it’s burned. Why use it in the future? Especially if people might notice it easily?
For older devices this might have blown a few holes in a slice of cheese (“am I talking to the correct server?”) and simplify other attacks a bit. But never forget: You cannot use this to access devices. You can only use that to tamper or wiretap with their network traffic if you’re in the right place to do so without someone noticing.

To be fair, revocation lists are public and you could check those on every connection. Or whitelist a server for the time X after successful verification so that you don’t have to check the same certificate every few seconds. But… that’s on the software you run. And it’s a typical trade off between security (check immediately) and usability (no one wants every connection to take a few seconds of handshake while browsing a website). And you need to think of this part of the security model. Guess how much thinking goes into security for many apps?

To be fair - those devices aren’t necessarily hacked because of this. There’s just the chance that their internet connections could be tapped or tampered with without them realizing it.