bugtraq - NetGear WAB102

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 9 Dec 2003 17:09:51 -0700
From: "Jon Kamm @hotmail" <jonkamm@...mail.com>
To: <bugtraq@...urityfocus.com>
Subject: NetGear WAB102

The NetGear WAB102 (running firmware v1.2.3) is a dual band wireless access
point. After a recent power outage I noticed that the unit reset its
password to the default of '1234'. Obviously this makes it possible for
someone to reconfigured it meet their needs... a significant security risk.
After further testing I discovered that any password with a space in it will
be accepted and will work as long as the unit is not powered off or reset.
Once reset it reverts to the default password.  All other settings remain
intact, WEP keys, IP addresses, etc. I found it particularly interesting
that you don't even have to login to the unit to get a list of wireless
stations accessing the unit ... makes it real easy to gather MAC addresses
to spoof.

NetGear notified a few days ago, they suggested I update the firmware to the
latest... it was already running it but I did it again for good measure...
no change. Other units may be affected.

Jon Kamm
NetKamm LLC