|
T of data on your network with GFI EndPointSecurity. FREE eval! Asante FM2008 10 100 Ethernet Switch Backdoor Login Vulnerability Posted on 16 December 2004 From: Joe Philipps <secfocus(at)joe.philipps.us>The Asante FM2008 is an 8 port managed Ethernet 10 100 switch. It may be managed, like many others in its device class, by Telnet, by serial port, by HTTP, or by SNMP. Also like most similar devices, the serial port, HTTP, and Telnet access methods require one to provide username password credentials. The firmware version "v01.06" has three UIs: Web browser, character cell terminal (Telnet serial port) with cursor positioning (hereafter just called "terminal"), and CLI. The access control model of that firmware shares one set of user-configurable credentials between the serial port, HTTP, and Telnet access methods. The "normal" terminal interface limits the "username" and "password" to eight characters each. The Web browser access method does not appear to have such limitations. The "alternate," or CLI, interface can be accessed via Telnet or the serial port by entering "superuser" for the username and "asante" for the password. This CLI is not documented in the User Manual, but one of the CLI commands is "help" which provides help (in English) of the available commands and their parameters. There is no command I can find to alter this set of credentials directly (although one of the memory address or port alteration commands may be able to do this). The backdoor cr edentials do
| Myspace baby icon | Myspace baby graphic | Myspace arrow cursor | Myspace anniversary graphic | Myspace anime layouts | Myspace anime layout | Myspace anime graphic | [ Myspace ]
|
