BugTraq
Unauthorized console access on Satechi travel router v1.5 Nov 22 2013 03:40PM
Luc Dore (ldore mailc net)
Satechi makes a travel router that broadcasts a protected wifi network that can be configured connect to either a wired or wireless network on it?s public (wan) interface. It runs a customized dd-wrt build from version 2.4

The router is configurable via a web interface available within its protected (pan) network.

A exploit is available when the router?s public interface is configured to use a wifi network; where the web management console is available externally via http. The router?s web management via wan setting has no effect in this particular situation. the web console is available via any browser like http://<ip of wan interface>

The exploit cannot be reproduced when the router?s public interface is on a wired network and in this case the web management via wan setting is behaving as expected.

Strong recommendation that users of the Satechi travel configure the router use http authentication to prevent unauthorized console access.

Vendor has been contacted

Luc Dore
ldore (at) mailc (dot) net [email concealed]

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQGcBAEBCgAGBQJSj3rrAAoJECRUoyVG3eALuIoL/jfLGmZ7MRZgacQUlqHplg1A
r1pZrrT44Cjp+uan67SIEU0xL7EFaJud5VuunMqWel9LrNTsrLKrqv+O81RNNFEM
nIYA7FDE3co3ECzG88Obc/eHDwhmWq10p216VWPi+Xl453iDvSLC8cue1DP1IW9r
qcZNGCBT/IQYAnTJwKRlze5mn11YGU5KXu5l4wt9QOit9o213bPAcbFunB0p8FCk
l6kD3d/pDaypAdFFnn8NHefxVF9+9AwV5OnWNXoCJl4Mf8m8UJv+wBKOF5q3k/sP
+cwI0x6pMCni26+09RtcF1KRyIJDpVc9c870/hrwFgYFd3dFiovdaSr4sdJVMm7t
IYWJ8fnWFKdDcIuna2RDYzXs5IIMRgiluDIX0ndPh/8b184DNjj/98we2GZHWtH9
6Y2mMoa6S69gUTwlFLbrxg43FG5exzgktLL8kS5UqvnKiE4CLvJYqdGymDapVmB/
pKugJanNDUChd/kzA71TuY0E3qVFVysZ/QywEA8SCg==
=3gbO
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus