full-disclosure - SMC Routers have remote administration enabled by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200404271734.31400.user86@earthlink.net>
From: user86 at earthlink.net (user86)
Subject: SMC Routers have remote administration enabled by default

Tested Model: 7008ABR (part number 950.7814 with firmware 1.032 installed)
Confirmed by another person on: 7004VBR (version 1, firmware 1.231)
Others may be vulnerable.

SMC broadband routers ship with remote administration enabled by default on 
their port 1900 on the WAN side of the router.  If you just pull one out of 
the box, plug it into your internet connection and go through the "Setup 
Wizard" then don't do anything beyond that point, port 1900 is open on the 
router and completely passwordless, allowing ANY arbitrary person to just 
visit http://1.2.3.4:1900/  where "1.2.3.4" is the router's external IP 
address and hit "Login" and have full control of the router.  This may allow 
an arbitrary person to expose the very machines being protected by the 
router.

Steps to reproduce:
1.  Reset the router to factory defaults, either by logging onto its remote 
administration page at http://192.168.2.1/ and clicking "Advanced Setup" then 
"Tools" then "Configuration Tools" then choose "Restore barricade to factory 
defaults" and click "Next."  Or by holding down the router's reset button 
with a paper clip for 30 seconds.

2.  After the router has been reset to factory defaults, visit its 
administration page at http://192.168.2.1/

3.  Click "login"

4.  Click "Setup Wizard" then "Next"

5.  Choose the appropriate connection type you have.

6.  When it is "connected" and you can web browse on the internet just fine 
behind it, go back to the router's administration page at http://192.168.2.1/

7.  Click "Advanced Setup" then "Status" and write down the router's WAN IP 
address.  (for example 1.2.3.4)

8.  Now using a computer that has a different external IP address (another 
machine on the internet), visit the router's port 1900 in your web browser 
http://1.2.3.4:1900/

You are then greeted with a login prompt.  Click "Login" and you have full 
control of the router remotely.  While you are there, click "Advanced Setup" 
and then "System" then "Remote Management" and you can verify "Remote 
Management" is supposedly disabled yet somehow you are *remotely* managing 
the device.

There are two workarounds:
1.  Enable the router's firewall in its "Advanced Setup"

2.  Forward port 1900 of the router to a non-existent internal IP address 
(such as 192.168.2.248 if it isn't in use).