ID: HIGH-03

Title: Configuration backup file decryptable using publicly disclosed key

Severity: High

CVSS Score: 7.5

CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description: The router’s configuration backup (config.bin) appears encrypted but uses a publicly dislosed DES-ECB key, documented in an openly available tool. Using one such tool (tp.rb), the backup was successfully decrypted to a plaintext configuration file (config.cfg) exposing several sensitive items, including web interface credentials as MD5 hashes (lgn_pwd, lgn_opswd), NAS credentials as both MD5 and NTLM hashes (nas_user_passwd_login_md5, nas_user_passwd_login_smb), the WPS PIN in plaintext (5g_wlan_def_pin, 5g_wlan_usr_pin), and the Wi-Fi pre-shared key in plaintext (5g_wlan_PskSecret). The use of a publicly disclosed key means that any configuration backup from any device in this product line can be decrypted by anyone with knowledge of this artifact, regardless of whether the backup originated from the target device. This key has also been identified as hardcoded in firmware memory.

Remediation: Replace the hardcoded shared DES-ECB key with a device-unique key derived from hardware identifiers. Replace DES-ECB with a modern authenticated encryption scheme. Avoid storing sensitive credentials in recoverable form within backup files.

More information: See Web Interface Analysis chapter.