Long term, brute force password guessing can be performed without being noticed. When the correct password is guessed, it can be used to view or modify router configuration. This may be particularly dangerous in installations where multiple routers have the same password. Every affected device must be powered off and back on in order to restore its normal functionality. The following table summarizes the CBOS software releases affected by the defects described in this notice and scheduled dates on which the earliest corresponding fixed releases will be available.
Dates are tentative and subject to change.
All dates are estimated and subject to change. Customers with contracts should obtain upgraded software through their regular update channels. There are two workarounds for this vulnerability. The potential for exploitation can be lessened by ensuring that Web access to the router is limited to a legitimate IP address. Alternatively, disabling the Web access completely will also prevent this vulnerability from being exploited.