There is a $30K+ “enterprise unified threat management” appliance that seems to have a hard coded backdoor super admin account that is not documented to purchasers. It certainly is not mentioned in the documentation. But, it can be seen plain as day to anyone looking at the firmware.

As a matter of fact, in recent years, the newsgroups are rife with complaints from admins that the first thing support wants when called is to be granted admin access from outside the perimeter. Naturally, due to the fact that firewall admins are likely to be somewhat aware of security, this tendency has raised a great deal of derision. The existence of a secret “super admin” account would certainly explain the desire of first level support techs to gain permission to logon.

Needless to say, URL fuzzying is nothing new. The point of this post series is to show that embedded devices can be susceptible to *very* trivial auth bypass bugs.

You’re so right, that we shouldn’t just rely on documented default accounts when trying to find a valid username/password combination. Reverse-engineering the firmware is definitely the way forward!

did I gave you some idea with my auth bypass for airspan prost antenna ? heheh ;)

good posts. ;-)

btw.. if your able to put your hand on a device with port 23 open and you have the firmware.. disassemble it, check if you can’t find a default login/passwd account in it.. i made a found during a pentest, apc battery had a backdoor account.. I’ve been able to go in debug mode and dump the eeprom then gain access to web interface. gg. :)

i know theres a couple of websites around there that giving out default password but you can be *really* surprised if u take a look by yourself.