SMCwhoops.txt

`Tested Model: 7008ABR (part number 750.9814 with firmware 1.032 installed)  
Confirmed by another person on: 7004VBR (version 1, firmware 1.231)  
Others may be vulnerable.  
  
SMC broadband routers ship with remote administration enabled by default on   
their port 1900 on the WAN side of the router. If you just pull one out of   
the box, plug it into your internet connection and go through the "Setup   
Wizard" then don't do anything beyond that point, port 1900 is open on the   
router and completely passwordless, allowing ANY arbitrary person to just   
visit http://1.2.3.4:1900/ where "1.2.3.4" is the router's external IP   
address and hit "Login" and have full control of the router. This may allow   
an arbitrary person to expose the very machines being protected by the   
router.  
  
Steps to reproduce:  
1. Reset the router to factory defaults, either by logging onto its remote   
administration page at http://192.168.2.1/ and clicking "Advanced Setup" then   
"Tools" then "Configuration Tools" then choose "Restore barricade to factory   
defaults" and click "Next." Or by holding down the router's reset button   
with a paper clip for 30 seconds.  
  
2. After the router has been reset to factory defaults, visit its   
administration page at http://192.168.2.1/  
  
3. Click "login"  
  
4. Click "Setup Wizard" then "Next"  
  
5. Choose the appropriate connection type you have.  
  
6. When it is "connected" and you can web browse on the internet just fine   
behind it, go back to the router's administration page at http://192.168.2.1/  
  
7. Click "Advanced Setup" then "Status" and write down the router's WAN IP   
address. (for example 1.2.3.4)  
  
8. Now using a computer that has a different external IP address (another   
machine on the internet), visit the router's port 1900 in your web browser   
http://1.2.3.4:1900/  
  
You are then greeted with a login prompt. Click "Login" and you have full   
control of the router remotely. While you are there, click "Advanced Setup"   
and then "System" then "Remote Management" and you can verify "Remote   
Management" is supposedly disabled yet somehow you are *remotely* managing   
the device.  
  
  
There are two workarounds:  
1. Enable the router's firewall in its "Advanced Setup"  
  
2. Forward port 1900 of the router to a non-existent internal IP address   
(such as 192.168.2.248 if it isn't in use).  
`