Onderwerp: SMC Routers have remote administration enabled by default

Tested Model: 7008ABR (part number 750.9814 with firmware 1.032 installed)
Confirmed by another person on: 7004VBR (version 1, firmware 1.231)
Others may be vulnerable.

SMC broadband routers ship with remote administration enabled by default on
their port 1900 on the WAN side of the router. If you just pull one out of
the box, plug it into your internet connection and go through the "Setup
Wizard" then don't do anything beyond that point, port 1900 is open on the
router and completely passwordless, allowing ANY arbitrary person to just
visit http://1.2.3.4:1900/ where "1.2.3.4" is the router's external IP
address and hit "Login" and have full control of the router. This may allow
an arbitrary person to expose the very machines being protected by the
router.

Steps to reproduce:
1. Reset the router to factory defaults, either by logging onto its remote
administration page at http://192.168.2.1/ and clicking "Advanced Setup" then
"Tools" then "Configuration Tools" then choose "Restore barricade to factory
defaults" and click "Next." Or by holding down the router's reset button
with a paper clip for 30 seconds.

2. After the router has been reset to factory defaults, visit its
administration page at http://192.168.2.1/

3. Click "login"

4. Click "Setup Wizard" then "Next"

5. Choose the appropriate connection type you have.

6. When it is "connected" and you can web browse on the internet just fine
behind it, go back to the router's administration page at http://192.168.2.1/

7. Click "Advanced Setup" then "Status" and write down the router's WAN IP
address. (for example 1.2.3.4)

8. Now using a computer that has a different external IP address (another
machine on the internet), visit the router's port 1900 in your web browser
http://1.2.3.4:1900/

You are then greeted with a login prompt. Click "Login" and you have full
control of the router remotely. While you are there, click "Advanced Setup"
and then "System" then "Remote Management" and you can verify "Remote
Management" is supposedly disabled yet somehow you are *remotely* managing
the device.


There are two workarounds:
1. Enable the router's firewall in its "Advanced Setup"

2. Forward port 1900 of the router to a non-existent internal IP address
(such as 192.168.2.248 if it isn't in use).

On Wednesday 28 April 2004 12:55, user86 wrote:
> There are two workarounds:
> 1. Enable the router's firewall in its "Advanced Setup"
>
> 2. Forward port 1900 of the router to a non-existent internal IP address
> (such as 192.168.2.248 if it isn't in use).

A third workaround on the 7008ABR with firmware 1.032 is to go into the
router's "Advanced Setup" click "System" then "Remote Management" and click
"Apply" (even without changing any setting) and port 1900 then closes itself.

On Thursday 29 April 2004 01:10, user86 wrote:
> On Wednesday 28 April 2004 12:55, user86 wrote:
> > There are two workarounds:
> > 1. Enable the router's firewall in its "Advanced Setup"
> >
> > 2. Forward port 1900 of the router to a non-existent internal IP address
> > (such as 192.168.2.248 if it isn't in use).
>
> A third workaround on the 7008ABR with firmware 1.032 is to go into the
> router's "Advanced Setup" click "System" then "Remote Management" and click
> "Apply" (even without changing any setting) and port 1900 then closes
> itself.

Ugh! Scratch that third workaround! I just found out that that third
workaround only works as long as the router stays up. If the router is
rebooted for *any* reason, such as during a power outage or by the user
through the web interface, port 1900 is open again when the router boots back
up!

Hi all,

I have tested this on a SMC 2404WBR (firmware 1.0.10) with the firewall
disabled and I get no response from port 1900.

Regards,
Michael Curtis

----- Original Message -----
From: "user86" <user86@earthlink.net>
To: <bugtraq@securityfocus.com>
Sent: Wednesday, April 28, 2004 12:55 PM
Subject: SMC Routers have remote administration enabled by default


> Tested Model: 7008ABR (part number 750.9814 with firmware 1.032 installed)
> Confirmed by another person on: 7004VBR (version 1, firmware 1.231)
> Others may be vulnerable.
>
> SMC broadband routers ship with remote administration enabled by default
on
> their port 1900 on the WAN side of the router. If you just pull one out
of
> the box, plug it into your internet connection and go through the "Setup
> Wizard" then don't do anything beyond that point, port 1900 is open on the
> router and completely passwordless, allowing ANY arbitrary person to just
> visit http://1.2.3.4:1900/ where "1.2.3.4" is the router's external IP
> address and hit "Login" and have full control of the router. This may
allow
> an arbitrary person to expose the very machines being protected by the
> router.
>
> Steps to reproduce:
> 1. Reset the router to factory defaults, either by logging onto its
remote
> administration page at http://192.168.2.1/ and clicking "Advanced Setup"
then
> "Tools" then "Configuration Tools" then choose "Restore barricade to
factory
> defaults" and click "Next." Or by holding down the router's reset button
> with a paper clip for 30 seconds.
>
> 2. After the router has been reset to factory defaults, visit its
> administration page at http://192.168.2.1/
>
> 3. Click "login"
>
> 4. Click "Setup Wizard" then "Next"
>
> 5. Choose the appropriate connection type you have.
>
> 6. When it is "connected" and you can web browse on the internet just
fine
> behind it, go back to the router's administration page at
http://192.168.2.1/
>
> 7. Click "Advanced Setup" then "Status" and write down the router's WAN
IP
> address. (for example 1.2.3.4)
>
> 8. Now using a computer that has a different external IP address (another
> machine on the internet), visit the router's port 1900 in your web browser
> http://1.2.3.4:1900/
>
> You are then greeted with a login prompt. Click "Login" and you have full
> control of the router remotely. While you are there, click "Advanced
Setup"
> and then "System" then "Remote Management" and you can verify "Remote
> Management" is supposedly disabled yet somehow you are *remotely* managing
> the device.
>
>
> There are two workarounds:
> 1. Enable the router's firewall in its "Advanced Setup"
>
> 2. Forward port 1900 of the router to a non-existent internal IP address
> (such as 192.168.2.248 if it isn't in use).
>
>

Hello guys,
I made little research over UPC network in my country and the discoveries
are more than alarming - 90% of users have the firewall disabled. The next
thing is that some routers from Edimax and Planet are apparently using
almost the same firmware - including with mentioned bugs, of course. It's
the users of those soho routers who're not reading buqtraq at all, I'll
suggest UPC doing some campaign about security.

Martin.

----- Original Message -----
From: "user86" <user86@earthlink.net>
To: <bugtraq@securityfocus.com>
Sent: Wednesday, April 28, 2004 6:55 PM
Subject: SMC Routers have remote administration enabled by default


> Tested Model: 7008ABR (part number 750.9814 with firmware 1.032 installed)
> Confirmed by another person on: 7004VBR (version 1, firmware 1.231)
> Others may be vulnerable.
>
> SMC broadband routers ship with remote administration enabled by default
on
> their port 1900 on the WAN side of the router. If you just pull one out
of
> the box, plug it into your internet connection and go through the "Setup
> Wizard" then don't do anything beyond that point, port 1900 is open on the
> router and completely passwordless, allowing ANY arbitrary person to just
> visit http://1.2.3.4:1900/ where "1.2.3.4" is the router's external IP
> address and hit "Login" and have full control of the router. This may
allow
> an arbitrary person to expose the very machines being protected by the
> router.
>
> Steps to reproduce:
> 1. Reset the router to factory defaults, either by logging onto its
remote
> administration page at http://192.168.2.1/ and clicking "Advanced Setup"
then
> "Tools" then "Configuration Tools" then choose "Restore barricade to
factory
> defaults" and click "Next." Or by holding down the router's reset button
> with a paper clip for 30 seconds.
>
> 2. After the router has been reset to factory defaults, visit its
> administration page at http://192.168.2.1/
>
> 3. Click "login"
>
> 4. Click "Setup Wizard" then "Next"
>
> 5. Choose the appropriate connection type you have.
>
> 6. When it is "connected" and you can web browse on the internet just
fine
> behind it, go back to the router's administration page at
http://192.168.2.1/
>
> 7. Click "Advanced Setup" then "Status" and write down the router's WAN
IP
> address. (for example 1.2.3.4)
>
> 8. Now using a computer that has a different external IP address (another
> machine on the internet), visit the router's port 1900 in your web browser
> http://1.2.3.4:1900/
>
> You are then greeted with a login prompt. Click "Login" and you have full
> control of the router remotely. While you are there, click "Advanced
Setup"
> and then "System" then "Remote Management" and you can verify "Remote
> Management" is supposedly disabled yet somehow you are *remotely* managing
> the device.
>
>
> There are two workarounds:
> 1. Enable the router's firewall in its "Advanced Setup"
>
> 2. Forward port 1900 of the router to a non-existent internal IP address
> (such as 192.168.2.248 if it isn't in use).
>
>