4 ms·
Interesting story but a CVE for this is a bit melodramatic and why no one takes security folk seriously (cry wolf too many times). OpenWRT ships with no passwo
by huang_chung 2y ago
Interesting story but a CVE for this is a bit melodramatic and why no one takes security folk seriously (cry wolf too many times).
OpenWRT ships with no password at all (!) with full root access on default install. The situation is the same: they politely suggest you change it from the default (blank) password but do not force you to do so.
By this logic every OpenWRT install (and many other softwares) dating back many years should be subject to CVE.
- NRv9tR 2y agoI assume you have to be on that network to access the login. I'm 95% sure it the UI/admin is not accessible to the internet by default... but also, yes that shit should be way better. Even Comcast and other ISPs have done better than this for a decade or more now.
- huang_chung 2y ago[flagged]
- anilakar 2y agoYup, worth a CWE but not a CVE.