[30752] in bugtraq
Re: Asus AAM6000EV ADSL Router Wide Open
daemon@ATHENA.MIT.EDU (cw)
Tue Jul 15 17:08:45 2003
From: cw <security@fidei.co.uk>
To: <jammin@life.eu.org>, <bugtraq@securityfocus.com>
Date: Tue, 15 Jul 2003 14:50:51 +0100
Message-ID: <2003715145051.545069@beddo>
In-Reply-To: <20030715130134.GC9083@brucia.ulcc.ac.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 8bit
On Tue, 15 Jul 2003 14:01:34 +0100, Ben Wheeler wrote:
> It's far worse than that, if the state in which my router was
> supplied is typical. As I received it, the webserver was enabled by
> default, *and* was accessible from the internet as well as the
> local network.
I too got my router from Solwise however I do not find this to be the case. I have no ip filters set up yet both the telnet and web servers are only accessible from the local network. This was true with both 71205a10 and 71205a32 firmware.
> Fortunately this
> has been fixed in the last flash update (71205a32) but this same
> update also removes the requirement to specify a username. You now
> only need any one of the valid passwords to login.
I did notice that too
*waits for another round of out of office/dead mailbox auto-responders*
