Software Engineering Institute

Some versions of the Multi-Tech ProxyServer products ships without a default password for the administrative interface permitting unauthenticated access via TELNET and HTTP. The administrative interface, or "supervisor" account, allows users to modify configuration settings on the ProxyServer device. At least the following versions of the ProxyServer products exhibit this condition:

• MTPSR1-100
• MTPSR1-120
• MTPSR1-202ST
• MTPSR2-201
• MTPSR3-200

This vulnerability is the result of weak authentication and access control policies and can result in one or more of the following impacts: unauthorized access, unauthorized monitoring, information leakage, denial of service, and permanent disability of affected devices.

Supply an administrative password when the device is installed. According to Multi-Tech:
"This product line has been discontinued for sometime. The vulnerability for the administrative password was addressed in the manual.  Telnet is still open and can be disabled through the software, as suggested."