3 ms·
This appears to use API endpoints that are available if the modem is in ISP mode and acting as the Wi-Fi, etc. Does this also affect the router when used in mo
by buro9 5y ago
This appears to use API endpoints that are available if the modem is in ISP mode and acting as the Wi-Fi, etc.
Does this also affect the router when used in modem mode?
- nly 5y agoHow is this not prevented by same origin policy etc?
- dividuum 5y agoSince they mention a DNS rebinding attack, I would assume the victim visits or is redirected to attacker.com. This then has all the JS to talk to the unsecured router API endpoints. Now after a few seconds the attacker.com's IP address is switched to 192.168.0.1 (or whatever the routers default IP is) and zap: the SOP is circumvented.
- stordoff 5y agoComments at /r/netsec[1] suggest yes, but I haven't verified this: > Just tried it on my device in modem-mode and it does indeed still expose the snmpGet endpoint. As suggested above, i've firewalled all traffic to 192.168.100.1 on my own firewall. [1] https://www.reddit.com/r/netsec/comments/pnzs0n/silently_unmasking_virgin_media_vpn_users_in/ https://www.reddit.com/r/netsec/comments/pnzs0n/silently_unm...