Title: Thecus NAS Server Plain Text Administrative Password
Date published: 13 January 2014
The Network Attached Storage (NAS) Administration Web Page for Thecus NAS Server N8800 transmits passwords in cleartext by default, which allows remote attackers to sniff the administrative password.
Thecus NAS Server N8800 Firmware 5.03.01
Description of Issue
The issue exists because by default the Thecus NAS Server N8800 sends NAS administrative authentication credentials in plaintext across the network. The credentials may be disclosed to attackers with the ability to intercept network traffic, which may enable them to gain unauthorised access to the NAS administrative interface.
Attackers can use a browser to exploit these issues.
ThecusOS 5 (32 bit):
ThecusOS 5 (64 bit):