bugtraq - Unauthorized console access on Satechi travel router v1.5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <364D07AE-223B-4988-916E-6A7C4F92250A@mailc.net>
Date: Fri, 22 Nov 2013 07:40:27 -0800
From: Luc Dore <ldore@...lc.net>
To: bugtraq@...urityfocus.com
Subject: Unauthorized console access on Satechi travel router v1.5

Satechi makes a travel router that broadcasts a protected wifi network that can be configured connect to either a wired or wireless network on it’s public (wan) interface. It runs a customized dd-wrt build from version 2.4

The router is configurable via a web interface available within its protected (pan) network.

A exploit is available when the router’s public interface is configured to use a wifi network; where the web management console is available externally via http. The router’s web management via wan setting has no effect in this particular situation. the web console is available via any browser like http://<ip of wan interface>

The exploit cannot be reproduced when the router’s public interface  is on a wired network and in this case the web management via wan setting is behaving as expected.

Strong recommendation that users of the Satechi travel configure the router use http authentication to prevent unauthorized console access.

Vendor has been contacted

Luc Dore
ldore@...lc.net

Download attachment "signature.asc" of type "application/pgp-signature" (672 bytes)