jandar1
join:2006-01-16
Middleburg, FL | reply to Oligarchy
Re: 2Wire Cross Site Request Forgery Vulnerability 2Wire 2701HG-B
Software: 5.29.109.11
With a system password set, none of those exploits work. It always prompts me to enter my current pass.
Simple enough fix. |
|
| said by jandar1:2Wire 2701HG-B Software: 5.29.109.11 With a system password set, none of those exploits work. It always prompts me to enter my current pass. Simple enough fix. This sounds nice but 2Wire/AT&T must be rolling it out slowly - its apparantly only available to some people so far.
If I go to "View Available System Upgrades" on my AT&T/2Wire 2701HG-B, which has never been updated since it came from AT&T, it shows none available....Software version is 5.29.109.5. :-(
So, while a fix is supposedly out there, its apparantly not out there for everyone yet.  |
|
| said by sasparilla:This sounds nice but 2Wire/AT&T must be rolling it out slowly - its apparantly only available to some people so far. AT&T claims they've already rolled it out to the majority of its customers. »tech.slashdot.org/tech/08/04/08/···14.shtml
None of this helps us poor HomePortal 1xxx users, since we can't use 5.xx firmwares. No update for us, it seems. My 1701HG remains very hackable. »AT&T claims this is fixed??? |
|
1 edit | reply to sasparilla
Note that the fix may not be in the form of a firmware upgrade. AT&T first fixed this issue on the 3800 series with a UI Hotfix that got applied. The firmware upgrade included the hotfix in it's code so the hotfix was no longer needed.
It might take awhile, but at least they are trying. |
|
1 edit | reply to jandar1
said by jandar1:2Wire 2701HG-B Software: 5.29.109.11 With a system password set, none of those exploits work. It always prompts me to enter my current pass. Hey Jandar, as an interested owner of another 2701GH-B that is susceptible to the exploits (got the 2701 from AT&T this week, v5.29.109.5), how did you get the updated firware?
As my 2701 is telling me no updates available when checking for firmware updates. And AT&T support site and 2Wire website do not have updates listed either.
Scott |
|
