I was port scanning my own isp-issued modem-router and stumbled upon something unsettling: looks like it is listening on ports 554, 7070 & 1863 on (almost) every ip of this interval: 192.168.0-255.1
I posted the full port scan on pastebin: here.
While most of those ip have port 554,7070 & 1863 there are some other ports that are being listened to only on specific subnets:
192.168.27.1 | 81/tcp open hosts2-ns | 7070/tcp open realserver
192.168.28.1 | 554/tcp open rtsp | 7070/tcp open realserver | 8888/tcp open sun-answerbook
192.168.42.1 | 81/tcp open hosts2-ns | 554/tcp open rtsp | 7070/tcp open realserver
192.168.44.1 | 81/tcp open hosts2-ns | 554/tcp open rtsp | 7070/tcp open realserver
192.168.183.1 | 554/tcp open rtsp | 7070/tcp open realserver | 8000/tcp open http-alt
192.168.230.1 | 110/tcp filtered pop3 | 554/tcp filtered rtsp | 1863/tcp filtered msnp | 7070/tcp filtered realserver
192.168.234.1 | 554/tcp filtered rtsp | 1863/tcp filtered msnp | 3306/tcp filtered mysql | 7070/tcp filtered realserver
Here is what I know about this modem:
- It is a CPE by vodafone for use in europe (italy, germany) and NZ marketed as Vodafone Station Revolution or EasyBox 804 (altough this has a different fw from mine).
- Extremely dumbed down web interface implemented as a plugin to Jungo (now Cisco) OpenRG 5.4 (Side question: the linux binaries look like they are from 2005. Is there any known exploit i should be aware of for this version of OpenRG?).
Can the community help me investigate the purpose of these open ports? I think it may be a possible security issue.