Secunia

Gary H. Jones II has reported two vulnerabilities in GigaFast EE400-R Broadband Router, which can be exploited by malicious people to cause a DoS (Denial of Service) and disclose some sensitive information.

1) The "backup.cfg" configuration file can be accessed directly without any authentication through the HTTP interface. This can be exploited to disclose the administrator's password and some other potentially sensitive configuration settings.

2) An error in the handling of DNS queries can be exploited to cause a vulnerable router to become non-functional by sending some malformed DNS queries.

Successful exploitation requires that the DNS proxy option is enabled.

Solution
Disable remote administration, filter access to the HTTP interface, and disable the DNS proxy option.

Provided and/or discovered by
Gary H. Jones II

Deep Links
Links available in Customer Area