BugTraq
LinkSys WRT54G administration page availble to WAN May 31 2004 04:51PM
Alan W. Rateliff, II (lists rateliff net) (4 replies)
Manufacturer: LinkSys (a division of Cisco)
Product: Wireless-G Broadband Router
Model: WRT54G
Product Page:
http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
Firmware tested: v2.02.7

In a recent client installation I discovered that even if the remote
administration function is turned off, the WRT54G provides the
administration web page to ports 80 and 443 on the WAN. The implications
are obvious: out of the box the unit gives full access to its administration
from the WAN using the default or, if the user even bothered to change it,
an easily guessed password.

I reported this to LinkSys (along with a number of other non-security
related issues) on April 28. I received no reponse addressing this, and no
updated firmware has yet appeared on their firmware page
http://www.linksys.com/download/firmware.asp?fwid=201

To work around this, you can use the port forwarding (irritatingly renamed
to Games and whatever) to send ports 80 and 443 to non-existant hosts. Note
that forwarding the ports to any hosts -- inluding listening ones if you are
actually running servers -- will override the default behavior.

On a personal note, there are a number of reasons for which I am thoroughly
disappointed with LinkSys since the acquisition by Cisco. For the sake of
what was once a rock-solid product and great brand name, I hope things
change soon.

--
Alan W. Rateliff, II : RATELIFF.NET
Independent Technology Consultant : alan2 (at) rateliff (dot) net [email concealed]
(Office) 850/350-0260 : (Mobile) 850/559-0100
-------------------------------------------------------------
[System Administration][IT Consulting][Computer Sales/Repair]

[ reply ]
Re: LinkSys WRT54G administration page availble to WAN Jun 02 2004 06:30PM
Jason Munro (jason stdbev com)
Re: LinkSys WRT54G administration page availble to WAN Jun 01 2004 02:43PM
Steffen Mueller (steffen mueller vision-it de) (1 replies)
Re: LinkSys WRT54G administration page availble to WAN Jun 01 2004 07:09PM
Valdis Kletnieks vt edu
Re: LinkSys WRT54G administration page availble to WAN Jun 01 2004 01:28PM
Matthew Gillespie (mgillespie socket net) (1 replies)
RE: LinkSys WRT54G administration page availble to WAN Jun 01 2004 03:56PM
Alan W. Rateliff, II (lists rateliff net)
Re: LinkSys WRT54G administration page availble to WAN May 31 2004 09:18PM
Matthew Caron (matt mattcaron net) (1 replies)
RE: LinkSys WRT54G administration page availble to WAN May 31 2004 10:58PM
Alan W. Rateliff, II (lists rateliff net)


 

Privacy Statement
Copyright 2010, SecurityFocus