ID: MEDIUM-05

Title: DES-ECB key hardcoded in firmware binary

Severity: Medium

CVSS Score: 5.9

CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Description: Static analysis of the httpd binary using Ghidra revealed a hardcoded DES-ECB decryption key embedded in the file_md5_des function. This key is used to encrypt and decrypt configuration backup files produced by the web interface. As the firmware is publicly available on the vendor’s website, the key is accessible to anyone without requiring physical access to a device. An attacker can extract the key through reverse engineering of the publicly available firmware and use it to decrypt any configuration backup, exposing sensitive data including credentials, WPS PIN and Wi-Fi PSK in plaintext as detailed in finding HIGH-03.

Remediation: Replace hardcoded cryptographic keys with device-unique keys generated at manufacturing time. Use a stronger encryption algorithm than DES-ECB, which is considered cryptographically broken. Store keys in a protected memory region inaccessible to static analysis.

More information: See Manual Firmware Analysis chapter.