Security: TG582n transmits occasionally the serial number unprotected over wifi

[#1]

Another issue with the TG582n when I tried it today was that I notice it broadcasts the serial number (without the CP) encrypted as part of the wifi beacon frame. I don't think it's a great idea to broadcast the default admin password to anyone in wifi range.
# iw dev wlan0 scan passive
[tt]BSS a4:b1:e9:XX:XX:XX(on wlan0) -- associated
TSF: 0 usec (0d, 00:00:00)
freq: 2437
beacon interval: 100 TUs
capability: ESS Privacy ShortSlotTime (0x0411)
signal: -47.00 dBm
last seen: 193 ms ago
Information elements from Probe Response frame:
SSID: PlusnetWirelessD1745D
Supported rates: 1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0
DS Parameter set: channel 6
ERP: <no flags>
ERP D4.0: <no flags>
RSN: * Version: 1
* Group cipher: TKIP
* Pairwise ciphers: CCMP
* Authentication suites: PSK
* Capabilities: 16-PTKSA-RC (0x000c)
Extended supported rates: 6.0 9.0 12.0 48.0
HT capabilities:
Capabilities: 0x181c
HT20
SM Power Save disabled
RX Greenfield
No RX STBC
Max AMSDU length: 7935 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: 8 usec (0x06)
HT RX MCS rate indexes supported: 0-15
HT TX MCS rate indexes are undefined
HT operation:
* primary channel: 6
* secondary channel offset: no secondary
* STA channel width: 20 MHz
* RIFS: 1
* HT protection: nonmember
* non-GF present: 1
* OBSS non-GF present: 1
* dual beacon: 0
* dual CTS protection: 0
* STBC beacon: 0
* L-SIG TXOP Prot: 0
* PCO active: 0
* PCO phase: 0
WPS: * Version: 1.0
* Wi-Fi Protected Setup State: 2 (Configured)
* Selected Registrar: 0x0
* Response Type: 3 (AP)
* UUID: 00f0dbd4-2ad1-53ba-9937-9f01182eaee4
* Manufacturer: Technicolor
* Model: Technicolor TG
* Model Number: 582n
* Serial Number: (THE SERIAL NUMBER WITHOUT THE CP)
* Primary Device Type: 6-0050f204-1
* Device name: Technicolor TG582n
* Config methods: Label, PBC
* RF Bands: 0x1
WPA: * Version: 1
* Group cipher: TKIP
* Pairwise ciphers: TKIP
* Authentication suites: PSK
WMM: * Parameter version 1
* BE: CW 15-1023, AIFSN 3
* BK: CW 15-1023, AIFSN 7
* VI: CW 7-15, AIFSN 2, TXOP 3008 usec
* VO: CW 3-7, AIFSN 2, TXOP 1504 usec
[/tt]

[#2]

Does that occur on other firmware versions or is that something to check on later?

[#3]

And that's a security issue because...?

[#4]

Oh come on you can't be serious?

[#5]

@ejs
If you disable WPS. does it still get broadcast?

[#6]

Quote from: Anotherone

Oh come on you can't be serious?

Absolutely serious!
Enlighten/educate me.

[#7]

Hack the connection, log in to the (Modem/)Router and then wreak what mayhem, you choose.

[#8]

It's part of the WPS info so wouldn't be broadcast without WPS enabled.
You could argue it doesn't matter because the serial number is broadcast on the LAN anyway. So if you hack the wifi password, you've got two ways to get the default admin password.

[#9]

Its a security issue as it means for example a disgruntled employee could get the router password and changed what ever settings they liked possibly using a wired pc on the premises.. The obvious solution is to change the default router password.. While Plusnet find a way to removed the serial number from being broadcast .
Update
Not sure my argument is now valid if its broadcast on the LAN anyway..

[#10]

But is it possible to hack a LAN connection from a WLAN connection or the WAN?

[#11]

By LAN I meant 192.168.1.* - ethernet or wifi doesn't matter if you are handing out the serial number by UPnP.

[#12]

using the default username and broadcast password it would be possible to telnet into the router, from there I'd guess anything is possible

[#13]

If you change the default password, does the changed password get broadcast?

[#14]

No I wouldn't have thought so, it's just the serial number (and model number). I saw the same WPS info supplied by an O2Wireless TG 587n v2 nearby, although I haven't seen that SSID recently.

[#15]

that's pretty much the same information on all routers if you use the correct sniffers, its the main reason why all security setup documents state you should change the admin password ASAP, in 2006 when it came out that the HH did this every one had a panic, news papers wrote great pages on the "fundamental security flaw in the home hub" without realising the security flaw in that thing was the inability to change the password and still use bt bb, hence why BT finally changed there netops policy, transmitted new firmware to the routers and changed there dslam to no password required.....
jump forward to 2013 and people newly aware are realising for the first time why the information (that does seem somewhat stupid to a lay person) has always stated you much change the password before using it...