$1199 cripple locked down router demanding app & Linksys CLOUD account to use it

[MrMobodies]

I was just looking at FTTP providers and came across one called Gigaclear which are providing these fancy looking routers.
Edit: My mistake $1999 is for a pack of three as pointed out by Ranayna and as in the URL below "3-pack" that I missed but I still think that is a lot of money for a locked down pile of p*ss.
https://www.linksys.com/us/whole-home-mesh-wifi/linksys-atlas-max-6e-tri-band-mesh-wifi-6e-system-3-pack/p/p-mx8503/

Linksys Atlas Max 6E: Tri-Band Mesh WiFi 6E System, 3-Pack
SKU MX8503

2.7 out of 5 stars. Read reviews for average rating value is 2.7 of 5. Read 29 Reviews Same page link.
IN STOCK: $1,199.99
Free Shipping on all orders.
Linksys Atlas Max 6E (AXE8400) unleashes the biggest upgrade to WiFi in a decade, bringing the ultra-fast, low-latency 6GHz band to every corner of your home. Use as a backhaul between nodes or connect directly for seamless video conferencing, working from home, remote learning, and even the latest AR and VR. Learn More
The first WiFi 6E system with mesh built-in*
The new 6 GHz band offers interference-free signal and ultra-fast speeds
Extreme speeds and limitless connectivity throughout your home
Coverage up to 9000 sq. ft., 195+ devices, and speed up to 8.4 Gbps**
Enough bandwidth to run video conferencing, working and learning from home, and AR/VR devices simultaneously

Apparently what I was reading that the Linksys MX8500 router they provide requires an "account" before you can start using it.
https://www.gigaclear.com/installation/setup-your-gigaclear-powered-by-linksys-router

1. Search for and download the ‘Linksys App’ to your mobile device. Open the Linksys App and create an account using your email address.

According to the manual attached and url:
https://downloads.linksys.com/support/assets/userguide/MX8500_USERGUIDE_EN.pdf

*You will create a Linksys account so you can use the app to view or change your system settings from anywhere you have an internet connection.
Among the many things you can do with your Linksys account:
• Change your Wi-Fi name and password
• Set up guest access
• Connect devices to Wi-Fi with WPS
• Block internet with parental controls
• Test your internet connection speed

*Sounds DEMANDING to me.
No I will not purchase a phone, create accounts and sign in just to set it up. I'd send it straight back and complain if one was given to me as part of the contract.

I question, does it have a basic built in webserver to be able to configure it without any need for mobile phone, a stupid "app", an account and dependency on Linksys hosting and registration/activation servers? I posted a couple of questions on their webpage and got some replies one of them that seems to miss the point.

MrMobodies · 8 hours ago 
Does the Android/IOS "app" require me to create an account in order to configure the router?
answer:
Linksys · 7 hours ago 
Yes, MrMobodies. A Linksys cloud account is a requirement to complete the set up process. To learn more, please click here: https://www.linksys.com/us/support-article?articleNum=317898

MrMobodies · 8 hours ago 
Say I don't have a mobile phone. Does this have a basic built in webserver so I can configure it without the need of anything else such as a mobile phone/software and connectivity to Linksys? So it will function regardless of what happens out there.
answer:
Linksys · 7 hours ago
Hi, MrMobodies,

The Linksys Atlas (MX8503) can only be configured using the Linksys App. No worries, you can still setup the Atlas with the use of any handheld devices such as iPad, iPod, and Tablet.

No worries? What if I don't have a phone or tablet (ipad, ipod) which I don't have and no intentions of buying them.
Completely ignore if I don't have any of these things.

According to this comment it doesn't seem to support VLAN and nothing mentioned in the manual about it see attached.

Ryan B · a year ago 
Great product....if you don't need PPPOE and VLAN
I bought this to replace my CenturyLink Fiber modem...which required PPPOE and VLAN tagging to interface with the fiber ONT correctly.

Even with the PPPOE password and correct VLAN/MTU settings, performance was abysmal (850mbps down, 40 Mbps up). I put my old CenturyLink modem in passthrough mode and reset the Linksys router....then added it after the CenturyLink modem....850mbps down/950mbps up.

Why is performance using PPPOE and VLAN tagging so hard manufacturers to get right?

Quite disappointing for a router that costs $1,199.99
With no built in webserver, restricted and locked down that you need an account with them to use it and the only means of configuration appears to be with a stupid  "app". Hardware looks great to me  but obviously I think they are treating customers like they are somewhat stupid and confused.

As an "easy" setup I should NOT require a working broadband connection (initially), a mobile phone, a Google or Apple account in order to install their stupid "app" and then have create another account on the Linksys servers just to use open the "app" and then have to sign in to that just to be able to setup it up or configure the router... UTTER BULLSHIT.

I don't trust any router that requires me to set up accounts where remote access is involved that is out of my control. It is a big nono and completely unacceptable if I can't switch the remote access off and I'd feel it doesn't belong to me.

What I expect:
Connect a laptop/pc to the router where it obtains an IP address, open a browser, type in default IP address of router in the address bar, type in default username and password, and there I am in to configure it.

Not so hard is it as opposed to purchasing phones, requiring a working broadband connection (for the sign up process) and setting up accounts, signing into those and depending Linksys website and services to work and if one day they stop supporting it. Ridiculous.
I wonder how this will go with product obsolescence?

Take a look at this part of the login:

Isn't that bad, they want to know your phone number and there's marketing.
Shame about the hardware but I consider it a pile of piss and an insult to the customer.

This the first time I ever heard of a router requiring a "cloud" account in order to use it.

I just found this on reddit:
https://old.reddit.com/r/HomeNetworking/comments/a6k9ey/why_is_linksys_routers_so_unpopular/

[–]schoolpaddled 1 point 3 years ago
In 2012, Linksys changed their firmware such that you needed to log in to a web portal to access your router:

https://tech.slashdot.org/story/12/06/29/1425210/cisco-pushing-cloud-connect-router-firmware-allows-web-history-tracking

Reports have started popping up that Cisco is pushing out and automatically (without permission) installing their new Cloud Connect firmware on consumer routers. The new firmware removes the user's ability to login and administer the router locally. You now must configure the router using Cisco's Cloud connect service. If that wasn't bad enough, *the fine print for this new service allows Cisco to track your complete internet history. Currently, it appears the only way to disable the Cloud Connect service is to unplug your router from the internet."
That was it for me: done. Seeya.
I am not sure what the status of that is now that belkin owns them, but nope, out.

So it is nothing new. If that happened to me unknowingly at first I'd go berzerk and "demand" a firmware revert to the one I brought it with.

*Disgusting so they not only do they change and cripple the firmware/restrict the user when they feel like it they also *own* the router you paid for and use it to spy on them as well.

What to do you think?

[Ranayna]

Just a side note: That thing does *not* cost $1,199.

It's just a bargain of $399 each 

The blurb you quoted is for a pack of three. That puts it into the typical pricerange of similar WiFi 6E routers.

But yes: Keep clear of managed stuff like this. The same is also true for several Netgear Routers and Switches.
And let's not forget the HP printers that need accounts now.

[Haenk]

Honestly, I don't think using a smartphone is too troublesome (maybe because I have grown up with configuring stuff via serial console, which really sucks).
There are plenty of services that require a 2FA nowadays, including banking, ebay, PayPal and so on. So a smartphone is an essential item, not optional.

However I find it annoying to require an online account, when it is absolutely not necessary at all. That really should be forbidden.

[Ranayna]

Using a smartphone is fine. Requiring a smartphone is not, in my opinion.
Any device with a webserver can be managed with a smartphone. If the developers gave that a little bit of thought, they may even have build the admin pages with responsive design. AVM does that decently well, you can fully manage a Fritz!Box with a smartphone, if you want to.
Without any shitty apps, or any online accounts.

[AndyC_772]

A while ago I sent back a Netgear WAC124 (wi-fi access point) for exactly this reason. Although it had the capability to be managed locally in the usual way, it would refuse access to the local admin interface if it had an internet connection, and insist on using an account via a Netgear server instead.

I replaced it with a WAC104 instead, which has no such limitation.

[magic]

You will create your account and you will be happy. BTW, you don't need to buy a phone, you can rent one

Too bad no one came up with a smartphone in the cloud yet, seems like an obvious business opportunity is here...

[JohanH]

Please don't call wireless access points "routers", unless they have built in routing capabilities.

[Ranayna]

@JohanH: That thing does have a WAN port and claims compatibility with ISPs, so i would categorize it as a router. It may not have the capabilities of a "real" router, but it is still a router.

[janoc]

Please don't call wireless access points "routers", unless they have built in routing capabilities.

There are very few "dumb" wireless access points that only bridge the wifi to the local network on the market today.

Most will actually create a separate network for wifi and route/NAT to the ethernet port (if it has only one) or between the WAN port and the ethernet/wifi (if it has separate WAN port like this device) unless configured otherwise. So "router" is a completely correct name for this gadget.

[JohanH]

Define "few". All APs I have in my house don't have any routing capability. A separate router provides that functionality.

Many cheap "wifi routers" do contain wireless functionality, a router, NAT, DHCP server, an ethernet switch and even a firewall, so yes in that case you may call it a "router" even if the name describes only one part of the functionality.

[madires]

This the first time I ever heard of a router requiring a "cloud" account in order to use it.

You'll own nothing and you'll be happy. BTW, Linksys is owned by Foxconn sine 2018.

Please don't call wireless access points "routers", unless they have built in routing capabilities.

This is a tricky one since the OS is usually linux. It can route IP but it might be not configurable via the web UI. Also, many WLAN routers can be set up as AP. Maybe we could say that a device is meant to be an AP or router based on the hardware configuation or intended design. I know about VoIP ATAs which support PPPoE (DSL).

AVM does that decently well, you can fully manage a Fritz!Box with a smartphone, if you want to.
Without any shitty apps, or any online accounts.

AVM offers FTTH routers with an SPF port.

[MrMobodies]

Please don't call wireless access points "routers", unless they have built in routing capabilities.

Interesting you say that and to me it looks ambiguous of them if they don't have routing capabilities or lack them.
Gigiclear refers to it as a router.
https://www.gigaclear.com/installation/setup-your-gigaclear-powered-by-linksys-router



Ah Gigiclear appears to refer to them as a routers

Maybe I should give them a call and find out if they are using CGNAT.
https://www.gigaclear.com/installation/setup-your-gigaclear-powered-by-linksys-router

And so does the manual:


Whether it is a router or not with WIFI I see no reason why Linksys should "demand" an online account with your telephone number in the creditations and depend on Linksys to setup or configure in order function. That to me is just stupid especially when they stop supporting it.

I see "Cloud router" in the manual.
Another stupid term, I think mean "remotely manufacturer managed" routers.

Next time someone talks to me about these wonderful amazing "new technology" things called "Cloud routers" over the phone they in for a challenge on what they mean and and what it actually does.

I just spoke to Gigaclear and that is NOT the main router. They provide a modem or termination device and I can connect whatever I want to it but they give out Linksys MX8500 as part of the package to use as an access point around the house and if I don't want it they won't send it out. Which is very nice.

Also they only offer 1 fixed IP address which is nice for a home.

[JohanH]

It's the overuse of the word "router" that I can't stand. I guess they use it as a marketing term and people associate it with wireless access points.

Of course if a device is running linux, it can do routing in software. But that might not be it's main purpose, especially if it's a wireless access point. Routing packets takes some serious hardware. Not a problem for a PC, but a small ARM device or whatever can't do it at network speed. The router I have, a Ubiquiti Erlite-3 has a dedicated ASIC that does the routing in hardware and is capable of routing real 1 Gbit/s between its network ports (WAN to LAN or 1st LAN to 2nd LAN).

[janoc]

but a small ARM device or whatever can't do it at network speed.

Sorry but that is a complete nonsense. Unless you are running gigabit and faster networks, then a small ARM devices are completely capable of routing packets completely in software and have been able to do it for many years. Even gigabit network is possible with some hardware support and sufficient memory.

What do you think is in all DSL modems, cable modems and low end networking hw from companies like Cisco? Custom ASICs? Dream on! A small ARM SoC running Linux - and barely anything else. E.g. my cable modem is running 1Gbps right now - and has a bog standard ARM chipset running Linux as router inside, with no special ASICs for handling the routing.

A typical consumer router isn't going to be routing between more networks than two and won't have any complex routing tables or rules. That CPU that often runs at hundreds of MHz or even GHz or two these days is literally doing nothing else but shuffling packets between NIC buffers and dealing with an occasional configuration change when the user opens the web interface. All perfectly in line of what a small ARM or MIPS SoC have been capable for years.

This is a pretty typical example of such (now 4+ years old) consumer router:
 
https://www.microcontrollertips.com/teardown-inside-tp-link-archer-c7-wireless-router/

Just a wireless SoC from Qualcomm (likely ARM or MIPS core) that handles both the 2.4GHz wireless and the main CPU functions and then a separate board for 5GHz radio and ethernet interfaces. And this has 1Gbps ethernet already.

Or the ASUS RT-N16 described here (article from 2012 - i.e. 10 years old!):

https://www.anandtech.com/show/6180/open-source-router-platforms

Runs on an old Broadcom all-in-one SoC with a small MIPS core:
https://www.witimes.com/wp-content/uploads/2009/06/4716_4717_4718-PB03-R.pdf  that does everything, including wifi.

You are likely confusing packet routing (which typically happens at the higher layers of the networking stack, such as dealing with IP packets) with packet switching e.g. handling ethernet frames - and that's running at network speeds and typically using dedicated chips.

[coppice]

It's the overuse of the word "router" that I can't stand. I guess they use it as a marketing term and people associate it with wireless access points.

Of course if a device is running linux, it can do routing in software. But that might not be it's main purpose, especially if it's a wireless access point. Routing packets takes some serious hardware. Not a problem for a PC, but a small ARM device or whatever can't do it at network speed. The router I have, a Ubiquiti Erlite-3 has a dedicated ASIC that does the routing in hardware and is capable of routing real 1 Gbit/s between its network ports (WAN to LAN or 1st LAN to 2nd LAN).

Routing 1Gbps is easy when you are routing big packets. When you want to route a lot of small packets, like VoIP, you need a lot more horsepower. Most consumer routers are built around custom chips, with an ARM core and peripherals crafted to shunt packets around with little CPU involvement. This works well when the CPU only needs to inspect the headers of large packets, and the router can saturate a 1Gbps internet connection. If they need to inspect the headers of many more smaller packets, most consumer routers struggle to route more the 10's of megabits of data.

[BrokenYugo]

I already run a openwrt router for other reasons (mostly SQM), but I'll add this to the list, bullshit indeed.

[madires]

Just a wireless SoC from Qualcomm (likely ARM or MIPS core) that handles both the 2.4GHz wireless and the main CPU functions and then a separate board for 5GHz radio and ethernet interfaces. And this has 1Gbps ethernet already.

Some numbers for a 720 MHz SoC: https://openwrt.org/toh/tp-link/archer-c5-c7-wdr7500#nat_performance

[SiliconWizard]

Generally speaking, keep clear of ANY router that has cloud-based management. It's just a pile of garbage.
That will narrow down your options severely though.

If in doubt, check whether the one you're buying is supported by OpenWRT or not. I bought a simple "router" just to make an additonal WiFi access point, and the bugger had cloud-based management crap. Even if you did not create an online account, it would still "phone home" on a regular basis. Fortunately, it was supported by OpenWRT, I installed it and have not regretted doing so. I suppose that would break the warranty though. Which I don't care since it was not an expensive device.

[iJoseph2]

I tried to use a Cisco 1921 (and a 1941 and a 867) as a router a couple years ago with a VDSL connection (35mbps I think).
It struggled horribly... it was the setting up and tearing down of connections that bogged down the cpu. Good luck trying to play an online game on an xbox through it.

The replacement model(s) ISR1000/ISR4000 were expensive and I think the ISR4000 suffers from the c2000 bug.

So, I started using OPNsense on a second hand HP Elitedesk 800 G2 SFF and it's never struggled. I believe you can put a wireless card inside and it can act as a wireless point as well.

I've never measured the power consumption though 

[madires]

The Cisco 1941 is good for up to 15 Mbit/s WAN traffic.

[MrMobodies]

Just found that they allow the user to downgrade on certain routers.

https://www.linksys.com/us/support-article?articleNum=138220

Rolling back the Linksys Smart Wi-Fi Router Firmware to the Classic web interface

We are sorry to see you downgrading to our Classic software (non- Linksys Smart Wi-Fi) on your Linksys Smart Wi-Fi Router.  Your Linksys Smart Wi-Fi Router with Linksys cloud account software provides you a new way to experience your connected home and a growing ecosystem of apps. By downgrading your firmware, *you are not able to take full advantage of your new Linksys Smart Wi-Fi Router.  For more information about Linksys Smart Wi-Fi please see our FAQs by clicking here.

Buzzword Bullshit: Ecosystem, apps, smart, smart wifi, cloud, new, "cloud account", experience, "connected home", "growing ecosystem"

*At least they get their local built in web server back and are "able" to login and and configure it offline like it was when they brought the router.

I am a home user and reading that made me angry with all those trendy, pretty, ambiguous sounding buzzwords "smart", "cloud" and a new one,"app ecosystem".  They think the "home user" is going to care about "apps installed in their router" than anything else and also spying on the user with this "cloud" firmware now isn't that taking advantage out of the user? They seem to care more about these "ecosystem of apps" than the ability to configure the router offline. I question if there is no internet how are they suppose to configure the router. I assume maybe if this "app" was install on their phone it might something locally but if there was no phone.

I wonder why are they sorry? That they can't collect statistics about the user with the classic firmware.

[Ranayna]

Great... Downgrading the Firmware of your internet router...
The one device that will always be susceptible to outside attack, that is the first, and in most SOHO settings your only, defense... Welcome to the next botnet

Just do not buy that crap.

[madires]

It's hard for a consumer to find a good router. The marketing departments sell you a cheap, crappy, insecure and home phoning plastic box as professional, high performance, super secure and cloud-whatever SOHO router. If you aren't a network pundit you're lost between piles of junk.

[nfmax]

It's hard for a consumer to find a good router. The marketing departments sell you a cheap, crappy, insecure and home phoning plastic box as professional, high performance, super secure and cloud-whatever SOHO router. If you aren't a network pundit you're lost between piles of junk.

This is not a pile of junk:

https://www.firebrick.co.uk/fb2900/

It's built in a metal box. Five years guarantee. Free software updates for the life of the product - automatically if you so choose. OTOH it's a router and firewall appliance, not a wireless access point. And it costs more than people are usually willing to pay, though less than the thread topic product.

[madires]

Lancom is in the same league and they also have models with WiFi.

[JohanH]

It's built in a metal box. Five years guarantee. Free software updates for the life of the product - automatically if you so choose. OTOH it's a router and firewall appliance, not a wireless access point. And it costs more than people are usually willing to pay, though less than the thread topic product.

If you have a properly built house, there is a place where fiber or copper enters your house. In this place you put your router/firewall. This is sometimes provided by the ISP (might be called a CPE). People need to realize that it is beneficial to place a wireless access point somewhere else in the house, and not in the cabinet/room where the router is placed. Therefore, it is good to separate the function of router/firewall and wireless access point.

If you don't want to use your ISP provided router/CPE and wants to use your own router, then it already implies that you have some knowledge about networking. It also requires that you are able to replace the ISP router, which might be difficult in some managed fiber networks. In my case I use a Ubiquiti Erlite-3 (Edgerouter Lite 3) router/firewall and the ISP is nice enough to provide a bridged port in their CPE (after asking). The Ubiquiti uses a debian based OS with vyatta based firewall on top with its, maybe a bit peculiar, cmdline interface. Web GUI. No cloud crap. I know their newer products have this cloud BS and I certainly encourage people to stay away from that (should be possible to turn off the cloud stuff at least in some of their devices or not to use it in the first place; look it up!). Then I have three wireless access points elsewhere in the house, of course wired with 1 Gbit ethernet.

You can still get the Erlite-3 in some places and its not that expensive (between $100-200?). There are also MikroTik alternatives that works just as well. If my Erlite-3 breaks (been running now for seven years), I think I'll upgrade it to an ER-4.

In the past (7+ years ago) I've used these combined router/wireless combos like Asus WL-500 and Linksys routers before that, but when I got fiber they weren't up to the task and already at 100 Mbit (up/down) they already sucked. I have no experience of today's combo devices, your mileage may wary, but I'm not going back to these all-in-one bells and whistles christmas tree devices, if only for the simple reason that the incoming router is in it's separate room/cabinet where wireless does no good because of the walls.

[MrMobodies]

I have got about 6 old Wdnap 350's with a WMS5316 controllers a couple of Drayteks, with all sorts of functionality. All are N 300mbps set at low power when they on and I have a box of them and other stuff I got in joblots for spares cheap off ebay that I brought cheaply over the years.

I am perfectly happy with them they do what I set them to do.

I remembered Netgear doing something similar in 2016 for the model up but not like this. I can't find the article now but as I remember if you upgrade to a certain firmware, they had two types I think, with some of their routers which is remote access controlled from their webservers for a monthly fee you can't revert back and I think it might have been the WDNAP360 ceiling dome thing.

I think I came across a firmware for the wdnap350 that had both options and a choice would appear after a factory reset and I read I can install that firmware and downgrade to standalone on that model. That sounds nice to have choices where you could do it for mass amounts of them when needed for convenience maybe temporary use where it could be reverted but I stayed away from the models that had that limitation/restriction as I did want to waste time and money with the risk of it automatically updating and then having start an argument on the phone to get them to replace it or it being a loss where it ends becoming no functional.

A while ago I sent back a Netgear WAC124 (wi-fi access point) for exactly this reason. Although it had the capability to be managed locally in the usual way, it would refuse access to the local admin interface if it had an internet connection, and insist on using an account via a Netgear server instead.

I replaced it with a WAC104 instead, which has no such limitation.

A little better than Linksys but it still sounds like harassment to me.

Great... Downgrading the Firmware of your internet router...
The one device that will always be susceptible to outside attack, that is the first, and in most SOHO settings your only, defense... Welcome to the next botnet

*Just do not buy that crap.

I don't know what's worse. Under attack from the manufacturer with their bullshit and spying or put at risk and possibly attacked with no longer maintained firmware by people who are not the manufacturers.

* The irony is you don't have buy these things they can be given to you as part of the contract by some ISP'S like the one I mentioned Gigaclear.
The good thing is that Gigaclear told me that was not the main router, it was just a freebee to help improve the wireless situation in the home.

Joke: Say I got one of these for free. I don't want this bullshit crippling stuff in my box of goodies designed and set by principle to restrict and insult the user. I don't want other people to find it in the dumpster and "experience" this "new cloud/app ecosystem bullshit" that is forced upon them. So I think it will be better for the "ecosystem" to burn it up in my trashcan and watch that magic smoke escape.

If you don't want to use your ISP provided router/CPE and wants to use your own router

I have some given to me which I find handy when I suspect there are problems with the broadband or physical line to rule out my equipment.

It is all in the cupboard on standby which I just swap out the VDSL cables over so my ISP can run tests and they have remote access to it I think through TRS069/ACS? and yes there are options to switch it off if I wanted to. Once they they are satisfied that all the tests have been done and if there is a fault they send out Openreach to investigate further.

One flaw with their router which is a Technicolour DWA0120 is that they set it to expose the built in webserver to port 80 of the gateway IP so anybody including the proxy server I tried it with can access it. No option to switch that off in the User or Engineers menu and no telnet access to do so. The config file and be decryped and encrypted but needs to be signed with a key for it to accept it. I spoke to someone a couple of months ago and apparently I can request them to switch off port 80 web server from being access by the gateway IP if I turn on the remote access stuff and they are able to connect to it. I think they refer to that as a dictionary "attack" when trying to guess the passwords if not trying by known vulnerabilities and no password attempt lockout policy is set.

[MrMobodies]

Great... Downgrading the Firmware of your internet router...
The one device that will always be susceptible to outside attack, that is the first, and in most SOHO settings your only, defense... Welcome to the next botnet

Just do not buy that crap.

Just found this article:
https://threatpost.com/linksys-smart-wi-fi-safe-home-router-flaws-classic-configuration-vulnerable-041113/77720/

Linksys Smart Wi-Fi Safe from Home Router Flaws; Classic Configuration Vulnerable
Author: Michael Mimoso
April 11, 2013  5:57 pm

Cisco clarified today that its Linksys EA2700 home routers running the new Smart Wi-Fi firmware released last June are immune to vulnerabilities disclosed this week by a researcher. EA2700 routers, however, that are still running on the classic EA2700 configuration remain vulnerable to a host of flaws and more than 2,000 vulnerable to an authentication bypass exploit can be found on the Shodan search engine. Cisco clarified today that its Linksys EA2700 home routers running the new Smart Wi-Fi firmware released last June are immune to vulnerabilities disclosed this week by a researcher. EA2700 routers, however, that are still running on the classic EA2700 configuration remain vulnerable to a host of flaws and more than 2,000 vulnerable to an authentication bypass exploit can be found on the Shodan search engine. A Linksys representative told Threatpost via email that the Smart Wi-Fi firmware, pushed close to a year ago, is not vulnerable to a handful of serious vulnerabilities in the home routers that are still present in boxes not running the new firmware. The flaws include cross-site scripting, file path traversal and authentication bypass vulnerabilities.

“If customers use methods of setup and configuration other than the methods recommended by Linksys, such as using Web browser setup (192.168.1.1), or if customers use older firmware, they could be at risk of potential attacks,” the Linksys representative said. “Accordingly, all Linksys EA customers are strongly encouraged to upgrade to the new Smart Wi-Fi firmware.”

A quick search on Shodan, a search engine created for the purpose of finding servers, routers, network devices and more that sit online, found 2,073 home routers vulnerable to an authentication bypass vulnerability disclosed by researcher Phil Purviance this week. Users can use Shodan to filter searches to find specific equipment by manufacturer, function and even where they’re located geographically.

“You can get a list of those routers with remote access enabled, meaning the owner of the router decided he may be away from home and still need to manage his options and settings, Purviance said. “Those 2,000 devices are all running the classic version of the firmware and you can take that authentication bypass vulnerability, exploit it and got to any one of those sites, change the password and get access to it.”

Purviance reported his findings to Cisco on March 5 and after an initial response from the company asking for the model number of version of the router he analyzed, never got a second response. No patches are available that repair the bugs in the classic set up. Purviance said he dug into the administration features on the router’s embedded management website, apply.cgi, and the vulnerabilities he found range in severity and simplicity to exploit.

“Any potential issues arising from the cited vulnerabilities have been eliminated in the latest version of the Linksys Smart Wi-Fi firmware that was made available last June. “This update was made seamlessly for customers with Smart Wi-Fi accounts,” the Linksys representative said. “ Those who have not signed up for Smart Wi-Fi were alerted to upgrade manually and are strongly encouraged to update their firmware to ensure that they have eliminated any potential issues relating to the cited vulnerabilities.”

Some users apparently balked at a forced upgrade on the EA routers, which were released in April and upgraded to the new firmware in June. Users were asked to register for a cloud-based service to enable automatic updates, transitioning router management to the user’s new Smart Wi-Fi account, and off the embedded Web-enabled interface. Purviance said language in the initial terms of service indicated Cisco could monitor the new cloud-based accounts, a situation that has since changed, he added.

“*There are still a lot of people running the classic model firmware and they are provided updates separately,” Purviance said, adding that the classic firmware option is still available as a download for users who want to downgrade off Smart Wi-Fi and manage their own device. “That’s what’s vulnerable, and not Smart Wi-Fi.”

Purviance discovered four serious vulnerabilities on the routers: a cross-site scripting flaw that could enable an attacker to modify the device and firmware; a file path traversal bug that could give an attacker remote access to password or configuration files; a cross-site request forgery vulnerability that would allow an attacker to change log-in information and remotely control the router; and a source-code disclosure vulnerability where an attacker could modify the URL of the admin interface and be presented with raw source code.

“We have and will continue to urge our customers to use our recommended methods of setup and configuration, and to change their user names and passwords periodically,” the Linksys representative said.

Looks like that classic firmware wasn't going to be of any help.
*Shame they couldn't wouldn't maintain the classic firmware version to appease the "lot" of people sticking to it.