ID: MEDIUM-10

Title: Unauthenticated access with read and write permissions to USB storage devices via deprecated SMB protocol

Severity: Medium

CVSS Score: 5.4

CVSS Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description: SMB folder sharing is enabled by default when a USB storage device is connected to the router (nas_smb_enable 1 in the decrypted configuration backup). Any device on the LAN can list available shares, connect to them, and perform read and write operations without providing any credentials. This was confirmed by successfully listing shares via anonymous access using smbclient, then connecting to the volume1 share and creating a directory without authentication. This means any LAN-connected device can read, create, modify, or delete files on any USB storage attached to the router. Additionally, the connection was established via SMB1 (SMBv1), a deprecated protocol version disabled by default in modern operating systems due to critical vulnerabilities.

Remediation: Require authentication for all SMB share access and disable anonymous or guest access. Disable SMB1 and enforce SMB2 or later. Require explicit user action to enable USB sharing rather than activating it by default when a device is connected.

More information: See Web Interface Analysis chapter.