Name: Kyle Young
Device: Netgear RP614v4
Firmware version: v1.1.2_09.01
Firmware release date: November 2009
HTTP service: Boa HTTPd 0.93.15
Exploit release date: Wednesday March 24, 2010
Default router credentials:
The Netgear RP614v4 is susceptible to an end user making a request for the netgear.cfg file which is located at:
This file, is a plain text ASCII file that contains the router’s password at line 216, which looks similar to this:
You don’t have to authenticate to obtain this file at all.
The qualm with this exploit is that, it works in the LAN that the router is on, or even remotely over a WAN, that is if the remote administration
option is enabled and the default port for this is 8080.
After discovering this vulnerability, I’ve noticed with other routers that have http based administration, is that you can make requests for config files without authenticating. However, this does not always work and at times the config file is obfuscated.
From my experience, most of the config files for routers are in a binary format and can be viewed with a program like ‘bvi‘. At times, you can view credentials to the device and also PPPoE credentials.
I’m reporting this vulnerability to securityfocus.com, due to the lack of support on Netgear’s end.