MediaLink MWN-WAPR300N Insecure Session

`*MediaLink router MWN-WAPR300N - Several Vulnerabilities*  
  
The vulnerabilities reported here are for the firmware version currently   
being shipped by Amazon.com. This is hardware version 2.0, firmware   
version V5.07.51_en_MDL01 . I have no knowledge of the behavior of   
previous versions of this router. U.S. CERT/CC states that the   
vulnerabilities I am reporting here have not previously been reported to   
them.  
  
*About*  
  
The MediaLink wireless router is a product sold by Mediabridge Products,   
a Chinese company with a U.S. office at 1951 Old Cuthbert Road, Suite   
301, Cherry Hill, NJ 08034 (see www.mediabridgeproducts.com/contact/).   
This is a low-cost (under $20) wireless router for home network use. The   
router inputs the ethernet WAN output of a cable or other modem or WAN   
source and outputs an Access Point LAN radio transceiver and four   
ethernet LAN device connections. This router appears to work reliably in   
my home in the N band on channel 8, connecting principally two computers   
and two printers.  
  
*Vulnerability Description*  
  
Note: vulnerabilities described elsewhere, such as the usual   
predefinition of "admin" and "admin" for the username and password for   
logging into the router control panel web page, are not included in this   
document. See CERT Coordination Center VU#630872 ("Mediabridge Medialink   
Wireless-N Broadband Router MWN-WAPR300N contains multiple   
vulnerabilities").  
  
1. This vulnerability is that there is no Logout or Logoff button or   
link on any page of the router control panel (accessed locally through   
the browser). In fact, although it is possible to configure the router   
with a management username and password, there is actually no way to log   
out of the control panel once one is logged in. This vulnerability has   
been confirmed by MediaLink technical support as follows:  
  
"MAY 02, 2016 | 08:53AM EDT  
*Tim* replied:  
...You are correct that at this time, our latest router firmware does   
not have a "Log Out Button". I will forward this to our engineers who   
handle the firmware revisions for future reference.  
Thanks,  
Tim M  
Mediabridge Products, LLC"  
  
2. There is no timeout for the current login session. Once someone is   
logged in, the control panel is freely available through the logged-in   
session and browser at the LAN IP address for the control panel (by   
default, 192.168.8.1).  
  
MediaLink technical support comments, "It is true that there is not a   
logout button in the interface. But closing the browser [or using a   
different computer in the network] accomplishes the logout." However,   
closing and reopening the Firefox browser (version 46.0.1) restores a   
tab showing the control panel, with all controls and interfaces still   
functional. This proves that no logout was done when the browser was closed.  
  
The same effect happens when a tab containing the control panel is   
closed, and then another tab containing the control panel is created.   
The new control panel tab is still in a logged-in state.  
  
However, the control panel is indeed logged-out when opened by a   
different browser, such as Chrome or Internet Explorer, or from a   
different computer on the LAN, as stated by Mediabridge.  
  
3. The username and password to allow control panel administration and   
configuration of the router are stored in cleartext in configuration   
files exported by the control panel's Backup operation.  
  
4. The router control panel uses HTTP access, not HTTPS, so WAN sniffing   
can eavesdrop on control panel operations.  
  
Respectfully submitted,  
  
David Spector,  
Springtime Software  
Portland, Maine  
www.springtimesoftware.com/contact.php  
  
  
  
`