next »

[aland]

I made a correction.  Originally, had 192.168.1.0 in posting.  Should have been 192.168.0.1.

I have dlink dir-615 ,firmware verision c with most recent firmware, 3.01.  When I go to the 192.168.0.1, I do get a login screen and prompts me for password.  However, what I have noticed is that if I go to a previous page in my browsers cach, say, 192.168.0.1/index.asp, I don't get prompted for password.  Takes me right to page and I can make changes

So I if anyone has this page in their cche, they can get access to router without using password. I have tried turning off router, then going to browser, and then going directly to the index.asp link , and, no password, lets my right in.  Again, if i go to 192.168.0.1 I get login screen.

My old router, Belkin, would time out and have a log out option. On this model, there is no logoff option. If someone has a dlink router, they could potentially see my router, go index.asp page and login.  I'm not broadcasting the ssid now and will turn on mac filtering, since this bothers me a lot.

I''m not a router expert, but am I missing something in setup?  Maybe it's staring me right in the face, but I don't see it.....

[thetrivialstuff]

I just ran into this too, and I think I figured it out -- it works by caching your MAC address. i.e. the router says, "OK, I've seen a valid login from aa:bb:cc:dd:ee:ff, so that computer knows the password" and then it caches that for an hour or so (you do have to re-enter the password eventually). Apparently this cache survives reboots of the router.

But anyway, that's why it still lets you in even if you clear all browser caches, cookies, etc. and even change IP addresses -- if you switch network interfaces though, even on the same computer and without clearing cookies (e.g. my laptop has wireless and Ethernet), it'll make you log in again.

This is still a security hazard, because it means that if you logged in to the router within the last while and happen to hit a website with malicious javascript designed to do things to home routers (e.g. turn on remote admin), it can do so.

~Felix.

[indale]

How do you set up WiFi access for a guest computer.  I know I've missed something, but when I get on WiFi I have to put in the 56 digit number.  How do I replace this with a simple password?  Thanks, my wife is depending on me!!

[FurryNutz]

Use WPA or WPA2 with Auto TPIK and AES cypher security under Wireless settings on the router. You can input any simple kinda of PW.

[indale]

Pretty simple.  Thanks