Router sends password plaintext: is this a serious vulnerability?

Question

Today I went to go & reset my router, but forgot the account password for the ISP. On the (extremely) off-chance of the password being present in the 'Password' field, I went to the appropriate page of the router's configuration settings (which is not secured using HTTPS) & found that the password had been blanked with dummy-characters (••••).

However, on viewing the page source the password is fully viewable, of which it's essentially this:

<input type="password" name="Password" value="SDrtdF">

_{obviously that's not my password, and I've also changed a couple of aspects of the HTML element to minimize exploitation}

The input value of the password field is provided by the router, and not by the browser (I don't use autofill or tools to remember passwords). For this example, the real password is SDrtdF, which is the value of the password field.

This essentially means that anyone who has access to the router* can easily retrieve the password for the account that connects to the ISP, and use it elsewhere for illegal means. Knowing how some ISPs can be (mostly denying there is a problem, taking a week to realise what the problem is, etc), the first the victim may know about it is when the ISP cuts them off and/or the Police come knocking on their door.

*if a computer on the network is infected with malware & if said malware sends back a copy of the source of every page visited, no 'physical' access to the router would be required.

---

It's a common practice on websites to use 'dummy' input in password/sensitive fields. Browser autofill doesn't even put the passwords in 'plain sight' like this.

It's obvious that the ISP password is supposed to be hidden (else, why denote it as a password field in the first place if the password is supposed to be visible?).

Should such a vulnerability be taken seriously? Is it worth making the router manufacturer aware (I'd say yes, since their other routers may also carry the same vulnerability?

_{N.B: I've already made the manufacturer of the router aware of this, and I'm not going to disclose the manufacturer or the model of the router until/if this is fixed, for safety of the vulnerable routers.}

Answer 1

Router admin authentication is required to expose the password plaintext.

This is a bad design for certain. It means the router is storing the ISP password in a reversible form. However, it has to reverse it to authenticate to the ISP. The real problem is that is unnecessary to expose.

This problem also exists on enterprise-level network gear. On Cisco firewalls it is possible to expose IPsec shared secrets and other similar symmetric/password credentials by running commands that show the configuration details from a CLI. This is done in part to support easily restorable backups of the config.

Exposing it in the user interface is unneccessary. This is an example of a Sensitive Data Exposure vulnerability (OWASP Top 10 2013-A6). It's considered to be hard to exploit (you need to be an admin on the router already), but high impact. In this case the value of the ISP client network authentication credentials is unlikely to be particularly significant. The ISP can have compensating controls in place and multiple authentications from separate locations would be an obvious violation that the ISP would notice.

I don't consider this to be a serious vulnerability. It should be addressed, but I don't consider it a show stopper requiring a different router to be deployed.