Full Disclosure mailing list archives
Re: yet another DSL modem backdoor - Mentor (Conexant)
From: "Philip Barnham" <admin () darktech org uk>
Date: Thu, 10 Feb 2005 13:27:42 -0000
the latest firmware fixes this issue, however manufacturers are still selling these items with non-updated firmware.
i always recommend anyone who buys one of these connexant based routers to upgrade the firmware, which a bootable upgrade cd can be downloaded from www.origo-repair.org.uk
----- Original Message ----- From: "Adam Laurie" <adam.laurie () thebunker net> To: "bugtraq" <bugtraq () securityfocus com>; "full disclosure" <full-disclosure () lists netsys com>
Sent: Wednesday, February 09, 2005 6:58 PM Subject: yet another DSL modem backdoor - Mentor (Conexant)
Amazingly, despite numerous reports of backdoors in these Conexant DSL routers, they are *still* being shipped with the port 254 backdoor menu enabled...I've just switched ADSL provider, and the new modem they sent me was a "Mentor MR4C/UK". It appears to be another conexant clone, and if you telnet to port 254 you get the familiar:01/01/99 CONEXANT SYSTEMS, INC. 00:00:38 ATU-R ACCESS RUNNER ADSL TERMINAL (Annex A) 3.27and options to set password, reset router to default values, etc. etc. As before, you cannot change the login password on this interface, which is, in this case, "conexant".Although this fault and the fix have been posted before, I report this as a reminder, and a nag to those feeble manufacturers that haven't got their act together...To work around, set up virtual servers that send the port to a black hole.If your ISP has shipped you one of these, *TELL* them! Maybe they have enough purchasing power to get it sorted...cheers, Adam -- Adam Laurie Tel: +44 (20) 7605 7000 The Bunker Secure Hosting Ltd. Fax: +44 (20) 7605 7099 Shepherds Building http://www.thebunker.net Rockley Road London W14 0DA mailto:adam () thebunker net UNITED KINGDOM PGP key on keyservers
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- yet another DSL modem backdoor - Mentor (Conexant) Adam Laurie (Feb 09)
- Re: yet another DSL modem backdoor - Mentor (Conexant) Philip Barnham (Feb 10)