Executive Summary

The vulnerability in KAYSUS KS-WR1200 routers with firmware 107 is that SSH and TELNET services are exposed on the LAN interface with hardcoded root credentials (username: root, password: 12345678). The administrator cannot disable these services or change the hardcoded password, and changing the management GUI password does not affect SSH/TELNET authentication. This means any attacker on the LAN side can easily log in with root privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows any attacker with access to the LAN to gain root-level access to the router. This can lead to unauthorized control over the device, potential interception or manipulation of network traffic, disruption of network services, and further compromise of connected devices.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by scanning your LAN network for devices exposing SSH or TELNET services on the KAYSUS KS-WR1200 router. Since the router uses hardcoded root credentials (root:12345678), you can attempt to connect via SSH or TELNET using these credentials to verify if the device is vulnerable. For example, use commands like: - SSH: ssh root@<router_ip> (then enter password 12345678) - TELNET: telnet <router_ip> (then login as root with password 12345678) Additionally, network scanning tools like nmap can be used to detect open SSH (port 22) and TELNET (port 23) services on LAN devices: - nmap -p 22,23 <network_range> If these services are open and accessible, the device may be vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include isolating the affected KAYSUS KS-WR1200 routers from the LAN to prevent unauthorized access, since the SSH and TELNET services cannot be disabled or have their hardcoded passwords changed. Restrict LAN access to these devices by implementing network segmentation or firewall rules to block SSH and TELNET ports (22 and 23) to the router. Consider replacing the device with a more secure alternative or contacting the vendor for firmware updates or patches addressing this issue.

Useful 0 Not Useful 0