dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
14335
share rss forum feed

info_dan

join:2010-04-30
Saint-Lambert, QC

[Info] WARNING: Belkin router F5D8233-4v3 is INSECURE

Hello to all,

I just wanted to inform you that I have discovered a major security flaw in Belkin's F5D8233-4v3 router. I obviously won't go into how, but suffice to say that it is possible for a hacker not only to bypass the login page, but also to SEE what the CURRENT ADMINISTRATION PASSWORD is.

I have advised Belkin a couple of weeks ago, but I did not get any feedback yet as to when a new firmware will be available (if at all...).

For now, I would strongly suggest the following:

1) DO NOT USE the Remote Management feature (found in System Settings), unless you specify a trusted IP address. If you leave Remote Management fully open, any hacker which scans for open ports and finds your router can enter and know the administrative password you're currently using (and obviously from there, know your wireless pre-shared key, see your DHCP server list, configure virtual servers, set-up a DMZ address, ...)

2) USE A UNIQUE PASSWORD for the router. Since there is no way to block the management feature to a specific IP on the LAN/WLAN side, you should consider that anyone on your local network can find your admin password, so make it very different from passwords you use on other systems.

My current firmware is 3.01.29, but I believe this issue is also present in previous firmwares. Could it be present in other models of Belkin router as well? I don't know, since I don't have access to those, but it is a possibility.

Side note: It has been reported that upgrading to 3.01.29 can cause problems with password recognition: Partly true. What actually happens is that with 3.01.29, you MUST click the SUBMIT button for the password to be recognized. If you simply type Enter after typing the password, you will get the "Incorrect Password" message. If you type your password and then click the Submit button, then it works.

Hope this helps someone!

Dan.

info_dan

join:2010-04-30
Saint-Lambert, QC

F5D8236-4v2 INSECURE as well

Hello again,

After discussions with Belkin, they have informed me that the F5D8233 was discontinued and there was no plan to issue a new firmware.

To solve my issue, they offered to replace my router with a F5D8236-4 router. I received it today, and as you can guess, the same security flaw exists.

This leads me to believe that most Belkin routers are probably insecure, and that the suggestions above should apply to all Belkin router (don't use remote management, consider your admin password as public knowledge...).

If you would like me to check if another model of belkin router is susceptible to this flaw, send me an email (click on "info_dan" at left), and we can arrange a time where I can connect to your router to test if I can see its admin password...

Dan.

info_dan

join:2010-04-30
Saint-Lambert, QC

1 recommendation

reply to info_dan

Update

After advising Belkin that the new router was insecure as well (and did not have wall mount capabilities like the F5D8233), they sent me another F5D8233-4, but this time a v4000 version, with a 4.x firmware (4.00.04).

I am happy to report that this router is OK. Now, my current belief is that 2.x (what the F5D8236 had) and 3.x firmware are insecure, but the problem looks fixed in 4.x firmware.

Hope this helps someone!

Dan.


lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
kudos:57
Well..thanks for all the info, Dan