Login without password + guest network access = security hole

[RocketJSquirrel]

I've found an interesting issue using the RT-N66U 3.0.0.3.162 firmware.

1. Guest WiFi network allows web access to the router via its LAN address even when intranet access is disabled in the web UI.
2. Sometimes I can log in to the router without being prompted for a password. It seems that if I have logged out recently, I can get right back in without a password.

Add these up and you have a security hole where a guest can access the router.

Is it just me? Or are these known bugs?

 

[morden]

I've done that many times (log out of the router and being able to get back in without needing to login) because I only end up closing the tab and not actually closing the whole browser.

That can be a security issue at home or at work if you logged into the router and then logout and close the tab up but left the rest of the browser running because someone else is able to log into the router and not have to enter the login information. I'm using firmware 3.0.0.3.178.15.

 

[claykin]

if you login using HTTPS the router should require credentials every time (after you close the browser window). If not, Asus has some security issues they need to correct.

 

[morden]

i haven't tested that yet as i just use the normal http to login to the router.

 

[sfalcon]

if you login using HTTPS the router should require credentials every time (after you close the browser window). If not, Asus has some security issues they need to correct.

HTTPS is supported by RT-N66U?
Please teach me how to enable it, thanks~

 

[claykin]

HTTPS is supported by RT-N66U?
Please teach me how to enable it, thanks~

RMerlin added HTTPS access to his custom build firmware. Not sure if Asus did same since then. You can see more about RMerlin's firmware here:

http://forums.smallnetbuilder.com/showthread.php?t=7715

 

[RogerSC]

RMerlin added HTTPS access to his custom build firmware. Not sure if Asus did same since then. You can see more about RMerlin's firmware here:

http://forums.smallnetbuilder.com/showthread.php?t=7715

In the .220 firmware, there's an "Authentication Method" dropdown in the "Administration" -> "System" tab. Haven't tested if it works, but it's there. I'm not sure when it was added, too many firmware versions *smile*.