*MediaLink router MWN-WAPR300N - Several Vulnerabilities*

The vulnerabilities reported here are for the firmware version currently 
being shipped by Amazon.com. This is hardware version 2.0, firmware 
version V5.07.51_en_MDL01 . I have no knowledge of the behavior of 
previous versions of this router. U.S. CERT/CC states that the 
vulnerabilities I am reporting here have not previously been reported to 
them.

*About*

The MediaLink wireless router is a product sold by Mediabridge Products, 
a Chinese company with a U.S. office at 1951 Old Cuthbert Road, Suite 
301, Cherry Hill, NJ 08034 (see www.mediabridgeproducts.com/contact/). 
This is a low-cost (under $20) wireless router for home network use. The 
router inputs the ethernet WAN output of a cable or other modem or WAN 
source and outputs an Access Point LAN radio transceiver and four 
ethernet LAN device connections. This router appears to work reliably in 
my home in the N band on channel 8, connecting principally two computers 
and two printers.

*Vulnerability Description*

Note: vulnerabilities described elsewhere, such as the usual 
predefinition of "admin" and "admin" for the username and password for 
logging into the router control panel web page, are not included in this 
document. See CERT Coordination Center VU#630872 ("Mediabridge Medialink 
Wireless-N Broadband Router MWN-WAPR300N contains multiple 
vulnerabilities").

1. This vulnerability is that there is no Logout or Logoff button or 
link on any page of the router control panel (accessed locally through 
the browser). In fact, although it is possible to configure the router 
with a management username and password, there is actually no way to log 
out of the control panel once one is logged in. This vulnerability has 
been confirmed by MediaLink technical support as follows:

"MAY 02, 2016  |  08:53AM EDT
*Tim* replied:
...You are correct that at this time, our latest router firmware does 
not have a "Log Out Button". I will forward this to our engineers who 
handle the firmware revisions for future reference.
Thanks,
Tim M
Mediabridge Products, LLC"

2. There is no timeout for the current login session. Once someone is 
logged in, the control panel is freely available through the logged-in 
session and browser at the LAN IP address for the control panel (by 
default, 192.168.8.1).

MediaLink technical support comments, "It is true that there is not a 
logout button in the interface. But closing the browser [or using a 
different computer in the network] accomplishes the logout." However, 
closing and reopening the Firefox browser (version 46.0.1) restores a 
tab showing the control panel, with all controls and interfaces still 
functional. This proves that no logout was done when the browser was closed.

The same effect happens when a tab containing the control panel is 
closed, and then another tab containing the control panel is created. 
The new control panel tab is still in a logged-in state.

However, the control panel is indeed logged-out when opened by a 
different browser, such as Chrome or Internet Explorer, or from a 
different computer on the LAN, as stated by Mediabridge.

3. The username and password to allow control panel administration and 
configuration of the router are stored in cleartext in configuration 
files exported by the control panel's Backup operation.

4. The router control panel uses HTTP access, not HTTPS, so WAN sniffing 
can eavesdrop on control panel operations.

Respectfully submitted,

David Spector,
Springtime Software
Portland, Maine
www.springtimesoftware.com/contact.php