Vulnerability leaves Cisco small biz routers wide open to attack A number of Cisco networking products for small businesses contain critical vulnerabilities that could allow attackers to gain root access to the equipment, the networking giant has warned. The affected products include the WAP4410N Wireless-N Access Point, the WRVS4400N Wireless-N Gigabit Security Router, and the RVS4000 4- …
And so he should. Journalists are paid to write stories from information they are given. He gave the journalist enough information to write the story. He shouldn't have to spoon feed them or bow and curtsy to them. The world doesn't owe journalists a living, they after all, should be just reporting facts.
Let's just call it backdoor, OK?. Now let's figure out if it is plain stupidity or a favor to a 3 letter US agency. It has been a long time since Cisco managed to get rid of back-doors in their products so my vote goes to the second alternative. Shame on you, Cisco!
Let's use some critical thinking here.
So, is the NSA interested in millions of small businesses around the world?
That is what product line is impacted, small business networking products for mom and pop shops, small insurance agencies and similar small businesses.
Really, now, do you honestly think that the NSA gives a tinker's damn about them over, perhaps, Fortune 100 companies or even better, Fortune 500? Or even better, every broadband provider, where they can slurp down all traffic to their heart's content?
Even better, try Hanlon's Razor.
Yes I'd bet it is the NSA backdoor, and yes the NSA are very interested in all. Everyone. Especially small connections. There numerous scripts will already have been installing things behind the routers, so will the Chinese of course. Nothing to worry about.
Do you really think that the NSA and Cisco are so stupid as to to have a backdoor that you simply telnet to?
A backdoor is supposed to be hidden and protected so that only those in the know can access it. Whilst the NSA might like access to your router they do not want others having the same ability.
This is simply some internal development test code that has been left in the production build by mistake.
This is part of a broader vulnerability for TCP-32764. It is conjectured that it was put in place by one, or more, SerComm engineers to allow resetting the devices that used their devices during the testing process in case the router locked up. Again, conjecture. The researcher that identified it has a PoC at GitHub: https://github.com/elvanderb/TCP-32764 . I'd include the suspect devices list except that link blows up here when placed in this reply.
Turns out that the Arris device used by ComCast routers here has the vuln. so it just isn't business, even just SMBs. It's a very popular device.
This post has been deleted by its author
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
