security in the old days (2008)

[Efried]

The setting of a new password may be seen in plain text when sniffing the Internet traffic:
 
Here is the GET request:
http: //mmm.nnn.x.y/netcfg.cgi?
0003W=NAME+++++++++&0000W=mmm.nnn.x.y&0001W=255.255.255.0&0002W=mmm.nnn.x.y&0009W=mmm.nnn.x.y&000AW=mmm.nn.xxx.yy&
0004W=user&0005W=password&0006W=0&0006W=1&0007W=0&0008W=0&0008W=1&Submit=Send+Settings
 
 
Nowadays I'm suspicious that my e-mail address was captured by spam bots because of the unsecured usage in the WC.....

 

[CAI_Support]

I am not sure how did you get that, network configuration is saved by POST, not by GET.

 

[Efried]

I am not sure how did you get that, network configuration is saved by POST, not by GET.

I revived an old device from 2008, no fake, this was the real but obfuscated URL.
Also with the new models, are you sure that men in the middle might not extract the password transmitted via POST in the Network Set-up?
sorry posted in the wrong forum..

 

[CAI_Support]

Might that be a BRE firmware board?  For PLC, network configuration is done through POST, not GET.

 

[Efried]

Might that be a BRE firmware board?  For PLC, network configuration is done through POST, not GET.

 
 
yes!

 

[CAI_Support]

Sorry, we do not have any firmware update for BRE firmware, because that is too limiting in features.  However, if you want, you could send your board in to re-program it into PLC version. If your board is hw rev 2.2.2, you can get bootloader with latest firmware.

 

[myyaz33]

I don't think exposing the device outside the LAN is a good idea anyway. Do you any options to use a VPN?

 

[CAI_Support]

Most routers support VLAN or secure tunnel function, WC does not support VLAN in itself, since it is designed to stay behind the router / firewall.  Through stunnel on the firewall/router, you can even configure the WC8 email notification to talk to SSL enabled email server.
 
There is a user by name WUENCH, posted how to configure stunnel on DD-WRT enabled router to send email to SSL email server through stunnel on this forum.  I think you can do similar to talk to the web gui port as well,.  A webcontrol user by name SALESGUY also configured that to send SSL email, posted on this forum.