Multi-Tech ProxyServer products MTPSR1-100, MTPSR1-120, MTPSR1-202ST, MTPSR2-201, and MTPSR3-200 ship with a null password, which allows remote attackers to gain administrative privileges via Telnet or HTTP.
Critical vulnerability exists in multiple Multi-Tech ProxyServer products due to a default null password, granting unauthorized remote access. Attackers can easily gain administrative control through Telnet or HTTP, potentially leading to complete system compromise and data exfiltration.
Step 1: Target Identification: An attacker identifies vulnerable Multi-Tech ProxyServer devices using network scanning tools (e.g., Nmap) to identify open Telnet (port 23) or HTTP (port 80) ports on the target IP address.
Step 2: Authentication Attempt (Telnet): The attacker initiates a Telnet connection to the target device.
Step 3: Authentication Bypass (Telnet): The attacker attempts to log in with a blank username and password, or simply presses enter at the prompt. The device, due to the null password, grants access.
Step 4: Authentication Attempt (HTTP): The attacker accesses the device's web interface via a web browser.
Step 5: Authentication Bypass (HTTP): The attacker attempts to log in with a blank username and password, or simply leaves the credentials fields empty and submits the form. The device, due to the null password, grants access.
Step 6: Administrative Access: Upon successful authentication bypass, the attacker gains administrative access to the device's configuration interface.
Step 7: System Compromise: The attacker can modify network settings, install malicious firmware, or gain access to sensitive information, leading to complete system compromise and potential network breaches.
The vulnerability stems from a fundamental security flaw: the devices ship with a blank, or null, password for the administrative account. The authentication mechanisms for both Telnet and HTTP interfaces fail to enforce any password protection, allowing unauthenticated access. The root cause is a lack of secure default configuration and a failure to require or enforce password changes upon initial setup. The absence of proper authentication allows attackers to bypass security controls and gain privileged access to the device's configuration and potentially the network it protects.