CVE-2004-2556 in WG602
Summary
by MITRE
NetGear WG602 (aka WG602v1) Wireless Access Point firmware 1.04.0 and 1.5.67 has a hardcoded account of username "super" and password "5777364", which allows remote attackers to modify the configuration.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/02/2024
The CVE-2004-2556 vulnerability affects NetGear WG602 wireless access point devices running firmware versions 1.04.0 and 1.5.67, representing a critical security flaw that compromises network infrastructure integrity. This vulnerability stems from the inclusion of hardcoded credentials within the device firmware, a practice that violates fundamental security principles and creates persistent attack vectors. The specific credentials consist of the username "super" and password "5777364" which are embedded directly into the firmware code rather than being dynamically generated or securely stored. This hardcoded account provides unauthorized remote attackers with persistent administrative access to the wireless access point configuration interfaces.
The technical implementation of this vulnerability falls under CWE-798, which specifically addresses the use of hardcoded credentials in software systems. The flaw represents a classic case of insecure configuration management where security-sensitive information is hardcoded into the application rather than being managed through secure configuration processes. The vulnerability enables remote code execution and configuration modification capabilities, allowing attackers to gain full administrative control over the wireless access point. This includes the ability to modify network settings, change authentication parameters, alter security configurations, and potentially redirect network traffic through the compromised device.
From an operational perspective, this vulnerability presents significant risk to network security infrastructure as it allows attackers to compromise wireless access points without requiring any additional reconnaissance or exploitation techniques. The remote nature of the attack means that an attacker can exploit this vulnerability from any location with network connectivity to the affected device, eliminating the need for physical access or local network presence. The impact extends beyond the individual device to potentially compromise entire wireless networks that rely on these access points for connectivity. Network administrators who are unaware of the hardcoded credentials may continue to operate with compromised devices, creating persistent backdoors in network infrastructure that can be exploited for extended periods.
The security implications of this vulnerability align with ATT&CK technique T1078.004, which covers legitimate credentials and default credentials for lateral movement and privilege escalation within network environments. This flaw enables attackers to establish persistent access points within wireless networks and potentially use the compromised access point as a stepping stone for further network infiltration. Organizations using affected NetGear devices face potential data breaches, man-in-the-middle attacks, and unauthorized network access. The vulnerability also demonstrates poor security practices in embedded system development where security controls are not properly implemented or tested. Network security professionals should immediately implement mitigation measures including device firmware updates, network segmentation, and monitoring for unauthorized configuration changes. The presence of hardcoded credentials in firmware also raises concerns about supply chain security and the need for proper security testing of embedded systems before deployment in production environments.
This vulnerability serves as a historical example of how insecure default configurations can create persistent security risks in network infrastructure devices. The flaw highlights the critical importance of proper credential management and secure configuration practices in embedded systems. Organizations should implement comprehensive security testing procedures for all network devices and maintain updated inventory records to identify potentially vulnerable equipment. The vulnerability also underscores the necessity of network monitoring and anomaly detection systems to identify unauthorized access attempts or configuration modifications that may indicate exploitation of hardcoded credentials.