Full Disclosure mailing list archives
Sweex 802.11g router/accesspoint config disclosure / remote config
From: Mark Janssen <maniac () maniac nl>
Date: Wed, 12 May 2004 18:29:52 +0200
Maniac Security Advisory 2004-01 Configuration disclosure on Wireless Accesspoint/Router SUMMARY Critical elements of the accesspoint's configuration can be discovered by any client connected to the accesspoint. This includes the administration username and password. AFFECTED PRODUCTS Sweex Wireless Broadband Router/Accesspoint 802.11g (LC000060) Unex WF514 (Unverified, but this appears to be the same device) DETAILS The configuration of the accesspoint can be 'backed-up' using tftp from any client that is connected to the accesspoint by requesting any filename from the tftp server (default 192.168.61.1) as long as the name starts with 'nvram'. Running strings(1) on the nvram file then reveals the admin username and password and other configuration data. Using the username and password the configuration webinterface can be accessed to modify the entire configuration. If the accesspoint is also used as a Broadband router that the username and passwords of these connections is also revealed. PREVENTION At the current time there is no known way to prevent this attack. The vendor has been notified May 12th. Copyright 2004 Mark Janssen, Syconos IT _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Sweex 802.11g router/accesspoint config disclosure / remote config Mark Janssen (May 12)