3 ms·

So from https://isc.sans.edu/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759 https://isc.sans.edu/diary/Port+7547+SOAP+Remote+Code+Ex

So from https://isc.sans.edu/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759 https://isc.sans.edu/diary/Port+7547+SOAP+Remote+Code+Execut... - this appears to be an attack on an externally visible port (7547) - There is publicly available exploit code for this issue (https://www.exploit-db.com/exploits/40740/ https://www.exploit-db.com/exploits/40740/) - There are at least 41 Million hosts on the Internet with that port open. Sounds like quite a few people are going to have a bad time over this, and I'm left once again shaking my head at how someone ships an Internet facing consumer device with an open port by default.....

atesti 10y ago
I see that the exploit sets an ntp-server with shell code in backticks. ok. But imagine the router did not have this exploit: Why on earth can anybody connect to that port and configure the NTP server? How is authentication for TR69 supposed to work??
- mgliwka 10y ago
  The original disclosure from kenzo2017 covers this: https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/ https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-... When Eir’s technical support want to manage the modem – maybe to reset the Wi-Fi password, they instruct the ACS (Access Control Server – the server used to manage the modems) to connect to the modem on port 7547 and send it a “connection request” command. The modem then connects to the ACS and Eir’s technical support can change whatever settings they want.