ID: INFO-19

Title: Insecure NAS Authentication Defaults — Inherited Credentials and Unauthenticated Remote FTP

Severity: Informational

CVSS Score: -

CVSS Vector String: -

Description: The NAS folder sharing feature exhibits two related authentication weaknesses. First, folder sharing defaults to using the same credentials as the web management interface via the “Use Login Account” option. This means that if the weak default web interface credentials are unchanged (admin/admin) these automatically extend to FTP access without any additional credential configuration. Second, when Remote FTP is enabled it defaults to no authentication, meaning a user enabling this feature without carefully reviewing the configuration would expose all connected USB storage to the internet without any access control. Even when authentication is enabled, the inherited default credentials provide negligible protection. Both issues place the burden of secure configuration entirely on the user, with the default state being insecure.

Remediation: Require explicit, separate credential configuration for NAS and FTP access rather than inheriting web interface credentials. Remote FTP should default to requiring authentication and should display a clear warning about internet exposure when enabled.

More information: See Web Interface Analysis chapter.