full-disclosure - Sweex 802.11g router/accesspoint config disclosure / remote config

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1084379392.4252.5.camel@ferrari>
From: maniac at maniac.nl (Mark Janssen)
Subject: Sweex 802.11g router/accesspoint config disclosure / remote config

Maniac Security Advisory 2004-01
Configuration disclosure on Wireless Accesspoint/Router

SUMMARY

Critical elements of the accesspoint's configuration can be discovered by
any client connected to the accesspoint. This includes the administration
username and password.

AFFECTED PRODUCTS

Sweex Wireless Broadband Router/Accesspoint 802.11g (LC000060)
Unex WF514 (Unverified, but this appears to be the same device)

DETAILS

The configuration of the accesspoint can be 'backed-up' using tftp from any
client that is connected to the accesspoint by requesting any filename from
the tftp server (default 192.168.61.1) as long as the name starts with 'nvram'.

Running strings(1) on the nvram file then reveals the admin username and
password and other configuration data. Using the username and password the
configuration webinterface can be accessed to modify the entire configuration.

If the accesspoint is also used as a Broadband router that the username and
passwords of these connections is also revealed.

PREVENTION

At the current time there is no known way to prevent this attack. The vendor
has been notified May 12th.

Copyright 2004 Mark Janssen, Syconos IT