TP-Link forgets to register domain name, leaves config pages open to hijack
12 07 2016In common with many other vendors, TP-Link, one of the world’s biggest sellers of Wi-Fi access points and home routers, has a domain name that owners of the hardware can use to quickly get to their router’s configuration page. Unlike most other vendors, however, it appears that TP-Link has failed to renew its registration for the domain, leaving it available for anyone to buy. Any owner of the domain could feasibly use it for fake administration pages to phish credentials or upload bogus firmware. This omission was spotted by Amitay Dan, CEO of Cybermoon, and posted to the Bugtraq mailing list last week.
Two domain names used by TP-Link appear to be affected. tplinklogin-dot-net was used, according to TP-Link, on devices sold until 2014. . . .
Together, these domain names appear to be quite busy; estimates based on Alexa’s ranking suggest that tplinklogin-dot-net sees about 4.4 million visits per month, with another 800,000 for tplinkextender-dot-net.
The content in this post was found at http://arstechnica.com/security/2016/07/tp-link-forgets-to-register-domain-name-leaves-config-pages-open-to-hijack/ and was not authored by the moderators of freeforafee.com. Clicking the title link will take you to the source of the post.
