Michael Domberg has reported a weakness in T-Com Speedport, which can be exploited by malicious people to brute force an administrative user's password.

The weakness is caused due to the delay routines for failed logins being implemented in Javascript and executed on the client side. This can be exploited by submitting the login request directly to the cgi script and allowing brute force attacks.

The weakness is reported in Speedport W 700V.

Solution
Disable remote administration.
Further details available to Secunia VIM customers

Provided and/or discovered by
Michael Domberg

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.devtarget.org/speedport700-advisory-05-2007.txt

Deep Links
Links available to Secunia VIM customers