CRITICAL Vulnerability in the 3.x firmware

[fajo]

I just opened a support ticket (EEW-834557) with Thecus to inform them about another critical vulnerability. The new 3.x firmware allows potential attackers to become any user (even "admin") bypassing the authentication. Exploits are available.

All users of devices running a 3.x firmware should make sure the WebUI is not accessible from insecure networks (such as the Internet) until this vulnerability is fixed.

Update 2009/11/26 - Received a reply from Thecus, they "hope it can be fixed soon"

/Falk

P.S.: I will not publish any details on the exploits ... but I will probably not be the only one who knows about this already

[jennyz]

Hi Fajo,

Will the vulnerability you have mentioned still be a problem if I used port 443 instead of port 80?

Thanks,
Jen

[fajo]

Will the vulnerability you have mentioned still be a problem if I used port 443 instead of port 80?

It will and there is no workaround available, so this will be an issue until Thecus decides to fix it. I did not receive a response from Thecus yet (as usual) except for the automatic response and I doubt this issue will be fixed soon.

/Falk

[jennyz]

Thanks for the reply. I hope Thecus will work on this soon or at least provide some reassurance that the next firmware update will address this problem.

Jen

[jennyz]

Hi Fajo,


Could you verify if this problem is fixed in the firmware v3.00.08?

Thanks,
Jen

[jennyz]

Hi Fajo,


Could you verify if this problem is fixed in the firmware v3.00.08?

Thanks,
Jen

You don't to answer my question. FW v3.00.08 does not work on my N7700.

[fajo]

Hi Jen,

even if 3.00.08 would work for you, the issue would still be there ;o)

/Falk

[jennyz]

Hi Jen,

even if 3.00.08 would work for you, the issue would still be there ;o)

/Falk

Falk,

I wonder will Thecus ever resolve this problem. I think we all need to do this to Theucs.

Thanks,
Jen

[jennyz]

Hi Falk,

Does the new beta: N5500 - N7700 - N8800 FW v3.01.00.3 solve the vulnerability issue? The text on this new version says that it solve the vulnerability issue that you found. Not that I don't trust them *ahem* but I like to hear it from you.

Thanks,
Jen

[fajo]

Hi Jen,

yes, with 3.1 the vulnerability is fixed - I have not updated the thread yet since this FW is still beta ;o)

/Falk

[jennyz]

Thanks Fajo!
I hope the beta won't crash my system.

Jen