2 ms·

I see that the exploit sets an ntp-server with shell code in backticks. ok. But imagine the router did not have this exploit: Why on earth can anybody connect t

by atesti 10y ago

I see that the exploit sets an ntp-server with shell code in backticks. ok. But imagine the router did not have this exploit: Why on earth can anybody connect to that port and configure the NTP server? How is authentication for TR69 supposed to work??

mgliwka 10y ago
The original disclosure from kenzo2017 covers this: https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/ https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-... When Eir’s technical support want to manage the modem – maybe to reset the Wi-Fi password, they instruct the ACS (Access Control Server – the server used to manage the modems) to connect to the modem on port 7547 and send it a “connection request” command. The modem then connects to the ACS and Eir’s technical support can change whatever settings they want.