How to remediate – Pirelli AGE mB Router Default Password (microbusiness) for ‘ad…

1. Introduction

The Pirelli AGE mB Router Default Password vulnerability affects microbusiness routers where the default administrator password (‘admin/microbusiness’) remains unchanged. This allows unauthorised remote access to the router, potentially disrupting internet connectivity and enabling malicious activity. Affected businesses could experience loss of service, data compromise, or network misuse. Confidentiality, integrity, and availability are all at risk.

2. Technical Explanation

The vulnerability occurs because the Pirelli AGE mB routers ship with a well-known default password that is often not changed by users. An attacker can use Telnet to connect to the router using these credentials and gain full administrative control. CVE-1999-0502 describes this issue. A simple example would be an attacker using a Telnet client to log in with username ‘admin’ and password ‘microbusiness’, then changing the administrator password or modifying firewall rules.

• Root cause: Use of weak default credentials on the router’s administrative interface.
• Exploit mechanism: An attacker uses Telnet to connect using the default ‘admin/microbusiness’ credentials, gaining full access to the router’s configuration.
• Scope: Pirelli AGE mB (microBusiness) routers are affected.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking its current password or attempting to log in with default credentials. A quick check involves accessing the router’s web interface and looking at user account settings.

• Quick checks: Access the router’s configuration page via a web browser (usually 192.168.1.1) and check the administrator username and password under System or Administration settings.
• Scanning: Nessus plugin ID 30457 may detect this vulnerability, but results should be verified manually.

telnet [router_ip_address]

4. Solution / Remediation Steps

The solution is to immediately change the default password on the router. Follow these steps carefully.

4.1 Preparation

• Back up your router configuration if possible, although this may also contain the current default password. Stopping services is not usually required for a simple password change.
• Change window: This should be done during off-peak hours, but is unlikely to cause significant disruption. Approval is not usually required for a simple password change.

4.2 Implementation

1. Step 1: Log in to the router’s web interface using the default credentials (admin/microbusiness).
2. Step 2: Navigate to the System or Administration section of the configuration page.
3. Step 3: Locate the password change option for the administrator account.
4. Step 4: Enter a strong, unique password and confirm it.
5. Step 5: Save the changes and restart the router if prompted.

4.3 Config or Code Example

Before

Username: admin
Password: microbusiness

After

Username: admin
Password: [your_strong_password]

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue.

• Practice 1: Enforce strong password policies, requiring complex passwords and regular changes.
• Practice 2: Implement least privilege principles, limiting access to only those who need it.

4.5 Automation (Optional)

Automation is not generally suitable for this vulnerability due to the lack of a standard API on these devices.

5. Verification / Validation

• Post-fix check: Attempt to Telnet to the router using ‘admin/microbusiness’. The connection should be refused or authentication should fail.
• Re-test: Repeat the detection steps from Section 3, which should no longer show a vulnerability.
• Smoke test: Verify that you can still access the internet and manage basic router settings with your new credentials.
• Monitoring: Check router logs for failed login attempts using default credentials as an indicator of ongoing attacks.

telnet [router_ip_address]
Trying 192.168.1.1... Connected to [router_ip_address].
Login username: admin
Password: microbusiness
Incorrect password

6. Preventive Measures and Monitoring

Update security baselines and consider adding checks in your deployment process.

• Baselines: Update a security baseline to include a requirement for changing default passwords on all new network devices.
• Asset and patch process: Include regular password audits as part of your asset management process.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Incorrectly entering a new password may prevent access to the router. Mitigation: Double-check the new password and ensure it is remembered.
• Roll back: If locked out, attempt a factory reset (consult the router’s documentation). This will erase all configuration data.

8. References and Resources

Links to official advisories and documentation.

• Vendor advisory or bulletin: No specific vendor advisory is available for this general issue, but consult Pirelli’s support website.
• NVD or CVE entry: CVE-1999-0502
• Product or platform documentation relevant to the fix: Consult the Pirelli AGE mB router user manual for password change instructions.