Routers that EXPOSE WEB GUI to WAN by default (Drayteks) & likely hacked router - Page 1
Forum section: electronics / general

author: MrMobodies
author_rank: Super Contributor
timestamp: March 24, 2025, 03:57:26 pm
content: I feel absolutely gutted.It is my fault I should have double checked.I suspect one or possible two routers connected to one another had been hacked in some way.After discovering early this morning what it was doing I put a stop to it but of course it is too late.Why is it for some routers I have to UNSET things to stop the UI portal from being exposed on the WAN IP by default?I did remember unsetting it for all four and obviously one slipped by?The other three I did unset.Some of the ISP provided Technicolour routers at one time use to do this about the early 2010's with no setting or way to switch it off which is why I pulled them out. I spoke to TalkTalk that provided them and they agreed it was a stupid idea but they couldn't help as they didn't know themselves (suppose to be technical support so they should know) or raise the issue but they didn't seem interested).WAN1 (static IP pool) -> Pfsense -> DMZ interface (bridged) -> DMZ switch -> Draytek router (VPN1)WAN2 (static IP pool) -> Pfsense -> DMZ interface (bridged) -> DMZ switch -> Draytek router (VPN2)With rules set (NOT) to stop traffic going out of the wrong interfaces I use to use them with 1:1 NAT until five years ago after I upgraded from Pfsense 2.2 to Pfsense 2.5 (same configuration) and I found it would no longer work (works for other things) and I did have a backup SSD I'd plug back in and even set it up on another to compare to and spent time looking at the open states with no success as to why but this way seems to work. In 2022 I switched the landline to VOIP phones due to the increasing cost and put some Drayteks behind the Pfsense to connect to this quad wan router also connected to a 4G modem. If the Pfsense stops so do the phones and that mean's I'll have to have another machine running. I could also connect them directly too instead through the DMZ but I left it like that to leave a spare port on them.Port 1: MGMT, Port 2: Pfsense, Port3: VOIP router, Port 4 (spare)A few weeks ago I saw in my syslog many failed attempts on VPN2 that i thought was for the VPN side on one of the VPN routers that I just use for thatA few days ago, I noticed the broadband service on the second line would drop off and reconnect like every few minutes on the WAN2 but not the WAN1.I see this syslog entry "Vigor: WAN2 PPoE -> send PADT to reset the out-of-order session"I thought it was a malfunction or a service issue. I saw the router either reset itself, the lights would just turn off or all the lights would remain on and a hanged state and a broadcast loop on startup like it does at startup (Broadcast loop) as I am using Vlans and seems to be like the built in switch is an unmanaged state at startup.)I thought well the other three seem alright, lets load the configuration from that one onto this one and swap it over. Same problem. Swapped power supply around and I spent days trying to find out. Now one of them, just hangs straight away after loading with nothing connected up and I am dumbfounded. So got a spare router (extactly the same out with the configuration from 2022, and it worked for a while then resetted. Then I noticed the same thing happen to the VPN2 router as well. No config file for VPN2 because I copied the configuration from VPN1 to mirror the VPN stuff. They'd be alright until the WAN port is plugged in.Now looking at the connections to VPN2 through the Pfsense bridge (DMZ) switch and noticed lots of connections to port 443 on VPN2 but not VPN1.I set some rules on the firewall for the DMZ side and it stopped resettingNow comparing VPN1 to VPN2:SSL settings switched on that exposes the WEB GUI to port 443.I opened a live proxy server and yes. No checks on certificate or anything and just brings up the router login page.What I find strange is, that was suppose to have a configuration copy from VPN1. The SSL options were switched off for WAN1, WAN2, AND VPN1 but not this one and it has the VPN tunnels I set via the config from VPN1.One port I use to configure and relay SYSLOG messages to the management LAN so I am worried now.I don't know what other access they had they beyond that. Whether they influenced it to malfunction or whether they did gain control. I have one of the affected routers (the one that now resets with nothing plugged into it) so I might connect it up and do some packet capturing.Looks like a big task ahead of checking things out.Anyone ever caught out by this WAN portal thing?Do you think that is silly to allow the router portal to be exposed to the WAN IP by default for anyone in the world to have access to?

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 24, 2025, 04:43:45 pm
content: To give you a quick idea what could have been done:A search for sss:vigor returned close to 600K hits, 200K in the UK.Maybe check your firmware version?https://www.trellix.com/blogs/research/rce-in-dratyek-routers/

author: MrMobodies
author_rank: Super Contributor
timestamp: March 24, 2025, 06:38:21 pm
content: Thank you very much. The article seems to match the symptoms I was seeing.It looks like I am right to be very worried.Quote from: PA0PBZ on March 24, 2025, 04:43:45 pmNot good as they all have firmware 3.8.8.3.It didn't 'appear' to affect WAN1 and VPN1 and they were on the same subnet as WAN2 and VPN2 but didn't have and SSL and WEB GUI exposed. I suppose it is possible they could have been affected but I will never know without replacing them. It was the bottom one doing the VPN2 that had the WEB GUI exposed and now I have to believe that even though they 'look' fine now that they have been compromised.I think they got in through that exposed port.Or someone could have found a vulnerability within the VPN itself or gained entry to one of the accounts by dictionary attacking the the extremely long passwords I set and turned the SSL and WEB gui on to give them more control.QuoteSo when it was resetting that was their failed attempt.QuoteIn this hanged state, the port lights constantly flash with whatever is plugged in.if I was to plug things in and out the port don't light up.The lights only seem to go out for the existing plugged in cables that are flashing.Looks like I am going to have change or replace with something newer.I'll take a look at that video soon.I am pretty annoyed and with myself that I set ALL THAT UP with all the effort it took me back in 2020 and 2022 to help prevent something like that from happening just for it to be compromised by one or two lousy settings that I have to REMEMBER to TURN OFF every time I setup one those Drayteks.What I am going to have do and should have done from the start is put the port 1's of those Drayteks to the MGMT switch on their own individual VLANs to firewall them off to control them better (for the config and syslog) where they can't just interact with any anything else on there like I did with everything else. Which would have helped reduce exposure if the SSL WEB GUI thing was switched on by the intruders.

author: Simmed
author_rank: Frequent Contributor
timestamp: March 24, 2025, 06:47:33 pm
content: im not router savvyso i am wonderinghow did they know you have a draytek ?do they have a way to ping something that replies "i am draytek, firmware xyz"?

author: MrMobodies
author_rank: Super Contributor
timestamp: March 24, 2025, 06:55:39 pm
content: They knew I had a Draytek by a simple port scan on port 443 of the WAN IP to see it was hosting a http service.All you have to do is put the WAN IP address of that router in your address barand you are presented with login, if you have the correct password or a vulnerability.That was not intended and the options for it happened to be switched on.I normally turn them off. Now if it happened to the others VPN1 and WAN1 routers (exactly the same models)then obviously for sure it would have been through the VPN itselfOn the Pfsense, when it was doing it last night they'd be packet loss and it'd just drop out.

author: MrMobodies
author_rank: Super Contributor
timestamp: March 24, 2025, 07:41:21 pm
content: Quote from: PA0PBZ on March 24, 2025, 04:43:45 pmAll this seems to have started on 22nd which is a Saturday ad according to the SYSLOG messages.I have two connections. First connection absolutely no problems or drops outs.The 2nd one would just go on and off on and off until it hanged attimes and the only difference is that exposed GUI on the WAN IP port of the VPN2 which also caused the WAN2 to hand (even thought SSL was switched off there) Obviously they got in through VPN2 and was able to reach WAN2.Other than that exposed GUI thing that has mainly been untouched since 2022 with a few accounts added on.It looks like it is worse than I thought and this wasn't just random but by campaign:https://www.ispreview.co.uk/index.php/2025/03/broadband-isps-report-uk-connectivity-problems-with-vulnerable-draytek-routers.htmlQuoteQuoteWELL WELL WELL... what a surprise..,because it exposes that the WEB GUI.BL**DY STUPID! IDEA and STILL is.Back 20 years ago I use to use other port numbers for things and in the mid 2010's it just makes me furious to see it switched on on the most obvious ports and for something like this was a big NONO.I remembered this happening with VirginMediabusiness broadband in 2014 when they took over NTL:Business. Some time after I upgraded to a Docsis 3 modem, on a port scan I can't remember whether it was port 80 or 443 but the router web portal appeared on the WAN address from a website port scan. I complained saying I was unhappy about this and want it changed. I don't want the whole world to have access to it they don't need to. After raising a ticket it got fixed some weeks later. It was still reachable from inside the lan to the WAN IP (frightened at first) but found it was no longer reachable elsewhere.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 24, 2025, 07:48:21 pm
content: Quote from: MrMobodies on March 24, 2025, 06:55:39 pmUnfortunately it's a lot easier than that:https://www.shodan.io/search?query=ssl%3AvigorUsing the same tool I found that there are 2201 Vigor's on your 31.120.0.0/16 subnet

author: MrMobodies
author_rank: Super Contributor
timestamp: March 24, 2025, 09:09:34 pm
content: So here are my quick options:Get Pfsense to do everything like before.No ideal. If it fails so will the phones.ISP'S Technicolour router.I have them here on standby to to show the ISP and rule out any problems with my equipment.It worked and not trouble or reset when I plugged it in place of the WAN2 for a few hours and then I ruled out the broadband service.Unfortunately it seems very limited and has this annoying dimming overlay after every dialogue that I can't kill.VLAN the managment side off with the firewall.The firewalls seem unreachable behind the LAN address so what I could do is create some 4 Vlans on the MGMT switch and put the port1's on them in there and just open the ports I need for the management side with the help of a few static routes for things such as the web configuration and syslog messages.Quote*That HAD been disable but it is still accessible when the SSL stuff is turned on by default.**It didn't affect the other two, WAN1 and VPN1 because it was switched off so most of that could have been avoided if that was the case if it wasn't switch on by the defaults.If the vulnerability was found within the VPN itself or on the WAN I could understand but for something like this due to exposed ports very disappointing coming from Draytek.I remember back in the days of my first router, a Netgear FVL328 in 2004, in 2008 a Cisco 2801 and it didn't use to do this. I did port checks at the time and that it just wasn't a good idea to leave open ports (especially port 80 and 443 directly to configure the router) in a way anyone can get to it let alone make it the default factory setting where I have to unset it.

author: MrMobodies
author_rank: Super Contributor
timestamp: March 24, 2025, 11:21:16 pm
content: Just saw the video... and what looks like port 80 opened to the built in webserver and for what?Quote from: PA0PBZ on March 24, 2025, 04:43:45 pmThat router came in 2019 (in pdf) so what is port 80? doing open like that.So it NEEDS port 80 or 443 to be opened to the built in web server and yes this was BOUND to happen from a long time ago if they keep leaving ports open like that. What's the point of a firewall if they are going to leave ports open unbeknown to the buyer for target practice. Not sure if port 80 was turned on on that 3910 or whether it is part of the default settings.Here is a video of the WAN2 getting hacked via the compromised VPN2(which would do it too)https://i.imgur.com/w8H7XqR.mp4Before i knew what it was doing I found it pretty scary.

author: MrMobodies
author_rank: Super Contributor
timestamp: March 25, 2025, 05:40:38 am
content: Since i turned off the SSL VPN stuff on that one doing the VPN2 which exposed the built in web server to the public WAN IP address unbeknown to me I had not have an occurrence and VPN seems stable observing it for a few hours but anyway decided now to I switch it off VPN1 and VPN2 (VPN2 was the affected one) for now as I no longer trust it or both of them.https://www.interfuturesecurity.co.uk/blog/2025/03/24/draytek-routers-why-are-they-being-disconnectedQuoteI think they maybe embarassed and refuse to offer the obvious reason that this was caused by a setting they set that that exposes the router that the user don't know about like maybe some of them here:https://www.reddit.com/r/sysadmin/comments/1ji0zkf/draytek_issues_in_the_uk_saturday_night_930pm/?rdt=55179https://status.wessexit.com/notices/0gdlad8vbnbwd6ly-we-re-currently-having-issues-with-draytek-routersQuoteMaybe it is STILL occurring because the new firmware update may not actually disable the exposure to the built in web server via the switched on SSL VPN (did they strengthen the login portal maybe?) and the attackers have found another way or vulnerability with the portal to get through it.I have been advised from the lovelly folks on Eevblog IRC, thanks Electrohead to start from scratch due to the possibility of other things being hacked through it. So download plain text config, examine it, then reload firmware onto switches, start the pfsense from scratch, same with the Drayteks and think about replacing the Drayteks with something similar.Halycon via IRC said he noticed issues with Draytek vulnerabilities and not to trust their settings and in this day and age on a 2019 router and I find out outrageous even for 2004 to open port 80 or 443 to it.