4 ms·

I don't like cybernews.com or their video, so here's the researcher's page with details: https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabilities/ htt

I don't like cybernews.com or their video, so here's the researcher's page with details: https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabilities/ https://james-clee.com/2020/04/18/multiple-wavlink-vulnerabi...

tomku 6y ago
This should almost certainly replace the current HFET link, it's much more informative than either the HFET or CyberNews articles.
- bmcn2020 6y ago
  Hi there, as I mentioned above: That original research only looked at one Wavlink router. This is the extended research with the help of two other researchers. And of course the attempted exploit from a malicious IP address which was detected only recently
- bmcn2020 6y ago
  Clee worked with Carta and Sasnauskas for months on this updated research so it's a bit unfair to imply it provides no value
  - tomku 6y ago
    Hey, author of the article that's now linked at the top of this page, nice to meet you. You wrote a fine article. You should be proud of it. I was wrong about which article should have replaced the blogspam link that originally graced HN, and your sibling comment to this one ("Hi there, ...") did a great job of explaining why with patience and politeness. The mods clearly agreed and made the right call. This comment I'm replying to, though... you don't need to do this. If it had been the only reply you posted, I would have come away from our exchange with a very different opinion of you, and that would've been a bit unfair. Just something to think about for the future.
    - bmcn2020 6y ago
      Hi, sorry about that. I agree
- dang 6y ago
  This comment was talking about https://news.ycombinator.com/item?id=25189673; https://news.ycombinator.com/item?id=25189673; we've since merged that thread into this one.
dehrmann 6y ago
It looks like the issue is the admin password gets exposed to everyone on the local network and there's an interface for running commands on the router as root from the local network? There's no mention if this is vulnerable to XSS which is the more interesting issue. Not to knock the researcher's work too much, but what he did was what people installing OpenWRT on devices have been doing for 15 years, and what he found is pretty typical. Except for the password in JS. That was just weird.
- vsareto 6y ago
  You don't need XSS, that's not interesting at all. You can get the admin password from an insecure page, and then there's also a page to run commands as root.
  - dehrmann 6y ago
    Right, but you have to be on the local network to do that...unless the webserver also listens on the WAN interface.
    - vsareto 6y ago
      He doesn't demonstrate an attack over the internet in this article, but this makes me think he did investigate it from a remote attacker perspective vs. local network: >So what does that get us from the perspective of a remote attacker? We have the ability to get the current admin credentials, and we can get a shell if the telnet binary is started. However, most remote attackers wont be able to solder on any wires, so I wasn’t going to stop there. >Going through the rest of the pages in the www directory, there is another web page that provides this interface: So you don't need telnet, but the creds being on the page + knowledge of the system command page would be enough to do whatever you wanted. Also see this follow-up research page on the same devices: https://james-clee.com/2020/04/23/more-information-disclosure-in-wavlink-devices/ https://james-clee.com/2020/04/23/more-information-disclosur... >Just a reminder – every screenshot below is of a web page that is externally accessible without requiring authentication and contains sensitive data.
    - 6y ago

tomku 6y ago

This should almost certainly replace the current HFET link, it's much more informative than either the HFET or CyberNews articles.

bmcn2020 6y ago
Hi there, as I mentioned above: That original research only looked at one Wavlink router. This is the extended research with the help of two other researchers. And of course the attempted exploit from a malicious IP address which was detected only recently
bmcn2020 6y ago
Clee worked with Carta and Sasnauskas for months on this updated research so it's a bit unfair to imply it provides no value
- tomku 6y ago
  Hey, author of the article that's now linked at the top of this page, nice to meet you. You wrote a fine article. You should be proud of it. I was wrong about which article should have replaced the blogspam link that originally graced HN, and your sibling comment to this one ("Hi there, ...") did a great job of explaining why with patience and politeness. The mods clearly agreed and made the right call. This comment I'm replying to, though... you don't need to do this. If it had been the only reply you posted, I would have come away from our exchange with a very different opinion of you, and that would've been a bit unfair. Just something to think about for the future.
  - bmcn2020 6y ago
    Hi, sorry about that. I agree
dang 6y ago
This comment was talking about https://news.ycombinator.com/item?id=25189673; https://news.ycombinator.com/item?id=25189673; we've since merged that thread into this one.

dehrmann 6y ago

It looks like the issue is the admin password gets exposed to everyone on the local network and there's an interface for running commands on the router as root from the local network? There's no mention if this is vulnerable to XSS which is the more interesting issue. Not to knock the researcher's work too much, but what he did was what people installing OpenWRT on devices have been doing for 15 years, and what he found is pretty typical. Except for the password in JS. That was just weird.

vsareto 6y ago
You don't need XSS, that's not interesting at all. You can get the admin password from an insecure page, and then there's also a page to run commands as root.
- dehrmann 6y ago
  Right, but you have to be on the local network to do that...unless the webserver also listens on the WAN interface.
  - vsareto 6y ago
    He doesn't demonstrate an attack over the internet in this article, but this makes me think he did investigate it from a remote attacker perspective vs. local network: >So what does that get us from the perspective of a remote attacker? We have the ability to get the current admin credentials, and we can get a shell if the telnet binary is started. However, most remote attackers wont be able to solder on any wires, so I wasn’t going to stop there. >Going through the rest of the pages in the www directory, there is another web page that provides this interface: So you don't need telnet, but the creds being on the page + knowledge of the system command page would be enough to do whatever you wanted. Also see this follow-up research page on the same devices: https://james-clee.com/2020/04/23/more-information-disclosure-in-wavlink-devices/ https://james-clee.com/2020/04/23/more-information-disclosur... >Just a reminder – every screenshot below is of a web page that is externally accessible without requiring authentication and contains sensitive data.
  - 6y ago