bugtraq - Re: Asus AAM6000EV ADSL Router Wide Open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 15 Jul 2003 14:50:51 +0100
From: cw <security@...ei.co.uk>
To: <jammin@...e.eu.org>, <bugtraq@...urityfocus.com>
Subject: Re: Asus AAM6000EV ADSL Router Wide Open


On Tue, 15 Jul 2003 14:01:34 +0100, Ben Wheeler wrote:
>�It's far worse than that, if the state in which my router was
>�supplied is typical. As I received it, the webserver was enabled by
>�default, *and* was accessible from the internet as well as the
>�local network. 

I too got my router from Solwise however I do not find this to be the case. I have no ip filters set up yet both the telnet and web servers are only accessible from the local network. This was true with both 71205a10 and 71205a32 firmware.

> Fortunately this
>�has been fixed in the last flash update (71205a32) but this same
>�update also removes the requirement to specify a username. You now
>�only need any one of the valid passwords to login.

I did notice that too

*waits for another round of out of office/dead mailbox auto-responders*