Bugtraq mailing list archives

Re: LinkSys WRT54G administration page availble to WAN


From: "Jason Munro" <jason () stdbev com>
Date: Wed, 2 Jun 2004 13:30:26 -0500

On 11:51:41 am 05/31/04 "Alan W. Rateliff, II" <lists () rateliff net> wrote:
Manufacturer: LinkSys (a division of Cisco)
Product: Wireless-G Broadband Router
Model: WRT54G
Product Page:
http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
Firmware tested: v2.02.7

In a recent client installation I discovered that even if the remote
administration function is turned off, the WRT54G provides the
administration web page to ports 80 and 443 on the WAN.  The
implications are obvious: out of the box the unit gives full access
to its administration from the WAN using the default or, if the user
even bothered to change it, an easily guessed password.

Testing this issue with a recently purchased WRT54G here showed that while
I can access the web interface on the WAN IP from the LAN behind the
linksys, I can not access it from another location on the WAN side.

\__ Jason Munro
 \__ jason () stdbev com
  \__ http://hastymail.sourceforge.net/



Current thread: