AI
Chain of Vulnerabilities in ISP-Provided Modems
A D-Link DSL-6740C modem provided by a Taiwanese ISP had more than 10 vulnerable services. Predictable credentials used the device MAC address. A low-privilege account (“user”/”user”) could escalate to admin by changing the user ID in a password-change request. SSH and Telnet were enabled from the WAN side. A broken IP whitelist allowed remote access. Command injection in ping and traceroute functions gave five CVEs. An authentication bypass via the config.xgi path dumped device configuration, including the MAC-based admin password. Another path, de file.xgi, allowed path traversal. The password-change API could be called without authentication. Combining these, an attacker could gain root and take over the device.
From a Free Bus Wi-Fi to Global Infrastructure Access
On a bus, the speaker found a router with an open UPnP service on port 5555, controllable without authentication. Port 80 ran an old BOA web server vulnerable to an authentication bypass known since 2022. A simple curl HEAD request bypassed login. The HTML showed the admin password in plaintext when the type=”password” attribute was removed. SSH was enabled, and its ping function had a command injection. A hidden account named after the vendor’s headquarters (Shinten) had a hardcoded password discovered in firmware. An MQTT subscriber ran with credentials visible in the command line. Using MQTT, the speaker could subscribe to all topics and issue remote commands to thousands of devices worldwide. GPS data revealed a bus company parking lot. The same router model was used by a US water plant, smart city systems, power transmission lines, ATM networks, and oil and gas facilities.
Vendor Responsiveness: CNA Refusals and the Role of MITER
Zyxel, a CNA, replied that the vulnerable device was end-of-life and refused a CVE. The speaker escalated to MITER, who pressured Zyxel; a CVE was issued after a month. Nokia responded to a similar finding with “we do not treat this weakness as a vulnerability” and asked for no public disclosure. Dasan products had the same UPnP flaw. Hyron devices had a Telnet-accessible command injection. Across all cases, vendors failed to fully disclose affected models. The speaker argued that EOL/EOS should not be an excuse to ignore vulnerabilities, and that CNAs should be held accountable via MITER escalation when they refuse.
A Web-Based Scanner for Non-Expert Users
To help users who lack security expertise, Steven built a web-based modem vulnerability scanner. It uses banner grabbing and a database of vulnerability fingerprints from the research. A user simply enters their public IP and clicks “Start Scan”. The scanner checks for all the flaws described in the talk. During the demo, it detected vulnerable devices in seconds. The speaker noted that some responses had fake server headers (Apache, Python), suggesting others were probing his research.
Takeaways: End-of-Life, Backdoors, and User Responsibility
Across 10+ device models, the team found over 30 vulnerabilities covering ADSL, GPON, and 4G/5G routers. Many products are end-of-support but still widely used. Vendors should define clear EOS timelines and not reflexively mark devices EOL after a report. ISP-provided modems should not be trusted; users must identify their device model, check for known vulnerabilities, and monitor network traffic. Router freedom laws (such as those emerging in Europe) would allow users to replace insecure ISP modems. The speaker urged treating modems and routers as zero-trust devices.
Notable Quotes
“the control panel is pretty much useless” Chiao-Lin “Steven Meow” Yu · ▶ 2:46
“we found about 60,000 vulnerable device online when the vulnerability were disclosed” Chiao-Lin “Steven Meow” Yu · ▶ 19:48
“we could subscribe all topic and see the status report from the device all over the world” Chiao-Lin “Steven Meow” Yu · ▶ 26:27
“we do not treat this weakness as a vulnerability” Chiao-Lin “Steven Meow” Yu · ▶ 32:51
“don’t trust of the product from any brand and throw your model or the router as a pier zero critical device” Chiao-Lin “Steven Meow” Yu · ▶ 38:53
Key Takeaways
- 30+ vulnerabilities across 10+ modem models from D-Link, Zyxel, Nokia, Dasan, and Hyron were disclosed.
- 60,000 devices were visible at disclosure; 20,000 remained unpatched eight months later.
- A single bus Wi-Fi router led to a backdoor that affected a US water plant and other critical infrastructure.
About the Speaker
Chiao-Lin Yu (Steven Meow) is a Senior Red Team Cyber Threat Researcher at Trend Micro Taiwan. He holds multiple certifications and has disclosed 30+ CVEs in companies like VMware, D-Link, and Zyxel. He has presented at HITCON Training, Security BSides Tokyo, and CYBERSEC. His expertise covers Red Team exercises, Web security, and IoT security.