ID: LOW-03

Title: DDNS credentials stored in plaintext in configuration backup file

Severity: Low

CVSS Score: 3.7

CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Description: When a Dynamic DNS provider is configured, the associated credentials are stored in plaintext within the configuration backup file (config.cfg), as confirmed by the fields ddns_noip_usr and ddns_noip_pwd. Unlike the web interface credentials which are at least stored as MD5 hashes, DDNS credentials receive no protection whatsoever. An attacker who obtains and decrypts the configuration backup, trivially achievable as described in finding HIGH-03, gains immediate access to the user’s DDNS account credentials in plaintext, which may be reused elsewhere.

Remediation: Do not store third-party service credentials in recoverable plaintext form. If credentials must be stored, use a strong, device-unique encryption scheme. Warn users about the sensitivity of the backup file.

More information: See Web Interface Analysis chapter.