nanog mailing list archives
Re: Yondoo provided router, has "password" as admin pw, won't let us change it
From: Eric Kuhnke <eric.kuhnke () gmail com>
Date: Wed, 8 Feb 2023 16:57:30 -0800
I agree, but if we start listing every massive security vulnerability that can be found on the intra-home LAN in consumer-grade routers and home electronics equipment, or things that people operate in their homes with the factory-default passwords, we'd be here all month in a thread with 300 emails. I'm sure this ISP will realize what a silly thing they did if and when some sort of worm or trojan tries a set of default logins/passwords on whatever is the default gateway of the infected PC, and does something like rewrite the IPs entered for DNS servers to send peoples' web browsing to advertising for porn/casinos/scams, male anatomy enlargement services or something. On Wed, Feb 8, 2023 at 3:28 PM William Herrin <bill () herrin us> wrote:
On Wed, Feb 8, 2023 at 2:36 PM Eric Kuhnke <eric.kuhnke () gmail com> wrote:I would hope that this router's admin "password" interface is onlyaccessible from the LAN side.This is bad, yes, but not utterly catastrophic.It means that any compromised device on the LAN can access the router with whatever permissions the password grants. While there are certainly worse security vulnerabilities, I'm reluctant to describe this one as less than catastrophic. Where there's one grossly ignorant security vulnerability there are usually hundreds. Regards, Bill Herrin -- For hire. https://bill.herrin.us/resume/
Current thread:
- Yondoo provided router, has "password" as admin pw, won't let us change it TACACS Macaque via NANOG (Feb 08)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it Eric Kuhnke (Feb 08)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it William Herrin (Feb 08)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it Eric Kuhnke (Feb 08)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it Jason R. Rokeach via NANOG (Feb 08)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it Todd Stiers (Feb 09)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it Dave Taht (Feb 09)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it William Herrin (Feb 08)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it Eric Kuhnke (Feb 08)
- Re: Yondoo provided router, has "password" as admin pw, won't let us change it Collider (Feb 08)
- Message not available
- Yondoo provided router, has "password" as admin pw, won't let us change it TACACS Macaque via NANOG (Feb 09)