Huawei Will Not Patch 3G Routers Vulnerabilities

A security researcher has several 3G routers from the Chinese manufacturer Huawei network several vulnerabilities discovered that the company will not patch. It involves 14 models used by ISPs around the world, including Tele 2 and E-Plus in Germany.

According to researcher Pierre Kim devices are poorly designed and they are full of vulnerabilities. For example, the password and the name of the administrator stored in plain text in a cookie, the DNS server can be modified without valid credentials, the wifi password can be retrieved without credentials and it is possible for one of the models without authentication to adapt the firmware.

Kim Huawei warned in August about the vulnerabilities, but the Chinese manufacturer announced it will release no security updates because the devices are no longer supported. Huawei also advises users to no longer supported models to replace them with new routers. Kim then finally decided to publish his research.

Manufacturer Danger Because Media Reports On Router Vulnerabilities

The South Korean manufacturer Zioncom network has media threatened with legal action if they write about vulnerabilities in the Toto Link routers the company. Security Researcher Pierre Kim had a large number of vulnerabilities in the Toto Link routers, which allow remote attackers the devices can take over completely.

Toto Link routers have in South Korea on the market for consumers and small businesses a 80% market share. In addition, the devices are sold worldwide. Kim decided not to inform the manufacturer about his findings and published his research last month on various mailing lists and its own weblog. In a reaction Zioncom says that reports on vulnerabilities is irresponsible and it is unverified information, making the company's reputation is at stake.

The manufacturer adds that the network does not compromise user privacy and security and to take legal action against media that spread false information and harming the reputation of the company and its products. Regarding the default password on the device, one of the problems discovered Kim, users are advised to change it. Also new firmware appeared to remedy the problems. Kim analyzed the firmware and suggests that the backdoor he discovered still present, just not being loaded at startup. In addition, the problem with some models would not be remedied.