Bugtraq mailing list archives
Re: LinkSys WRT54G administration page availble to WAN
From: Matthew Caron <matt () mattcaron net>
Date: Mon, 31 May 2004 17:18:48 -0400
Isn't that the Linksys product that runs Linux and all these folks have been making custom firmware for? If so, can't one of those folks fix this bug if Linksys it taking too long?
Alan W. Rateliff, II wrote:
Manufacturer: LinkSys (a division of Cisco) Product: Wireless-G Broadband Router Model: WRT54G Product Page: http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601 Firmware tested: v2.02.7 In a recent client installation I discovered that even if the remote administration function is turned off, the WRT54G provides the administration web page to ports 80 and 443 on the WAN. The implications are obvious: out of the box the unit gives full access to its administration from the WAN using the default or, if the user even bothered to change it, an easily guessed password. I reported this to LinkSys (along with a number of other non-security related issues) on April 28. I received no reponse addressing this, and no updated firmware has yet appeared on their firmware page http://www.linksys.com/download/firmware.asp?fwid=201 To work around this, you can use the port forwarding (irritatingly renamed to Games and whatever) to send ports 80 and 443 to non-existant hosts. Note that forwarding the ports to any hosts -- inluding listening ones if you are actually running servers -- will override the default behavior. On a personal note, there are a number of reasons for which I am thoroughly disappointed with LinkSys since the acquisition by Cisco. For the sake of what was once a rock-solid product and great brand name, I hope things change soon.
-- Security through obscurity falls apart when someone steals your source code. -------------------------------------------------------------------- PGP Key: http://www.mattcaron.net/pgp_key.txt ~~ Matt Caron ~~
Current thread:
- Re: LinkSys WRT54G administration page availble to WAN Steffen Mueller (Jun 01)
- Re: LinkSys WRT54G administration page availble to WAN Valdis . Kletnieks (Jun 01)
- <Possible follow-ups>
- Re: LinkSys WRT54G administration page availble to WAN Matthew Caron (Jun 01)
- RE: LinkSys WRT54G administration page availble to WAN Alan W. Rateliff, II (Jun 01)
- Re: LinkSys WRT54G administration page availble to WAN Matthew Gillespie (Jun 01)
- RE: LinkSys WRT54G administration page availble to WAN Alan W. Rateliff, II (Jun 01)
- Re: LinkSys WRT54G administration page availble to WAN Jason Munro (Jun 02)
- RE: LinkSys WRT54G administration page availble to WAN Humes, David G. (Jun 02)
- Re: LinkSys WRT54G administration page availble to WAN Peter Becker (Jun 03)
- Re: LinkSys WRT54G administration page availble to WAN Paul Wouters (Jun 04)
- Re: LinkSys WRT54G administration page availble to WAN Peter Becker (Jun 03)
- Re: LinkSys WRT54G administration page availble to WAN Jerry Zwanenburg (Jun 04)