Security Issue -- GRAX66 / AX6600-E / AXE6600 -- IPv6 Security Vulnerability -- SSH open to Internet on IPv6 -- Firewall broken for IPv6

A

anthony.metzidi153b02d0

Member
Joined
Nov 26, 2023
Messages
32
Seems like IPv6 security configuration is broken on GRAX66 . SSH is listening and available to internet on IPv6, despite "LAN-ONLY" setting.

There are other serious IPv6 Issues:
  • * DNS/ port-53 is open to internet . this is a big risk since port-53 is unauthenticated.
  • * Firewall does not support IPv6 configuration. There's no way to block IPv6 traffic on the router settings.

STEPS to REPRODUCE
1. enable IPv6 + ssh ( LAN-only ) setting
2. connect to SSH from internet

ACTUAL RESULTS
1. ssh connection works (this is bad)

EXPECTED RESULTS
1. ssh connection should fail

Example Config
See Advanced ➡Administration ➡System Management
1701627300875.png

TEST SSH FROM INTERNET
Bash: 
ssh ubnt@$addr
ubnt@xxxxx: Permission denied (publickey).
PORT SCAN FROM INTERNET
Bash: 
nmap -6 xxxxx
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-03 10:13 PST
Nmap scan report for xxxxxx
Host is up (0.019s latency).
Not shown: 993 closed tcp ports (conn-refused)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
1080/tcp filtered socks

Firewall Configuration shows SSH listening on IPV6 ALL Interfaces
Preferred configuration should listen only on LAN interface
Bash: 
 netstat -l |grep 22
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0      0 :::22                   :::*                    LISTEN
udp        0      0 :::49622                :::*

Device Information
Hardware = MSI AX6600-E / GRAX66
Firmware: 692763
 
Last edited:
Sort by date Sort by votes
I was told that sudo privilege won't be enabled. UPNP option is being worked on and will be available in the next BETA (some time in Jan apparently).
 
Upvote 0 Downvote
These are serious security holes. This product that is supposed to be a security device. It is hard to excuse not testing to verify you cannot access the web and ssh interfaces from the WAN.
 
Upvote 0 Downvote
I know that. But it's not up to me to fix anything. MSI's router department or whoever they are are aware of this.
 
Upvote 0 Downvote
Nichrome said:
I know that. But it's not up to me to fix anything. MSI's router department or whoever they are are aware of this.
Click to expand...
Understood, and I appreciate you doing your best to raise the visibility of these issues to MSI.

In the less than 24 hours I've been using this device I've found two additional software bugs (DHCP IP reservations do not work and WiFi passwords that contain spaces do not work). I've submitted these as "Web Tickets" in the Support area. Is that the correct approach as you all understand it, or is there an actual bug ticketing system that's public facing?
 
Upvote 0 Downvote
Unfortunately web ticket is the only way to raise anything with MSI. And sometimes through the forums, we tend to report more major problems directly.
 
Upvote 0 Downvote
We have a new BETA available if you want to try.

MSI Tool Summary - Router

Firmware Update Tool >>> Read this before updating <<< Only try this when you cannot update firmware via MSI webUI. Use it as last resort after you've tried everything to recover the router in case it goes bad. Update Tool
sites.google.com sites.google.com
 
Upvote 0 Downvote
You'd have to work for MSI 🙃
You can contact MSI about this, but I really doubt they'd send any equipment out.
 
Upvote 0 Downvote
Back
Top