Vulnerability Note VU#950576
DSL routers contain hard-coded "XXXXairocon" credentials
CWE-798: Use of Hard-coded Credentials
DSL routers, including the ASUS DSL-N12E, DIGICOM DG-5524T, Observa Telecom RTA01N, Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN and Kasda KW58293, and ZTE ZXV10 W300 contain hard-coded credentials that are useable in the telnet service on the device. In the ASUS, DIGICOM, Observa Telecom, and ZTE devices, the username is "admin," in the PLDT devices, the user name is "adminpldt," and in all affected devices, the password is "XXXXairocon" where "XXXX" is the last four characters of the device's MAC address. The MAC address may be obtainable over SNMP with community string public.
A remote attacker may utilize these credentials to gain administrator access to the device.
The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround:
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|AsusTek Computer Inc.||Affected||04 May 2015||25 Aug 2015|
|DIGICOM (HK)||Affected||-||25 Aug 2015|
|Observa Telecom||Affected||-||25 Aug 2015|
|Philippine Long Distance Telephone||Affected||02 Jun 2015||27 Aug 2015|
|ZTE Corporation||Affected||03 Dec 2013||25 Aug 2015|
CVSS Metrics (Learn More)
Thanks to Walter Mostosi for reporting the issue affecting ASUS devices, Naresh LamGarde for DIGICOM devices, and to Eskie Cirrus James Maquilang for PLDT devices. Thanks again to Cesar Neira for reporting the issue in ZTE devices, and to Jose Antonio Rodriguez Garcia for disclosing the Observa Telecom vulnerability to Full Disclosure.
This document was written by Joel Land and Garret Wassermann.
- CVE IDs: Unknown
- Date Public: 25 Aug 2015
- Date First Published: 25 Aug 2015
- Date Last Updated: 27 Aug 2015
- Document Revision: 18
If you have feedback, comments, or additional information about this vulnerability, please send us email.