My home modem-router is occupying most subnets

Question

I was port scanning my own isp-issued modem-router and stumbled upon something unsettling: looks like it is listening on ports 554, 7070 & 1863 on (almost) every ip of this interval: 192.168.0-255.1

I posted the full port scan on pastebin: here.

While most of those ip have port 554,7070 & 1863 there are some other ports that are being listened to only on specific subnets:

192.168.27.1  | 81/tcp   open  hosts2-ns | 7070/tcp open  realserver
192.168.28.1  | 554/tcp  open  rtsp      | 7070/tcp open  realserver | 8888/tcp open  sun-answerbook
192.168.42.1  | 81/tcp   open  hosts2-ns | 554/tcp  open  rtsp       | 7070/tcp open  realserver
192.168.44.1  | 81/tcp   open  hosts2-ns | 554/tcp  open  rtsp       | 7070/tcp open  realserver
192.168.183.1 | 554/tcp  open  rtsp      | 7070/tcp open  realserver | 8000/tcp open  http-alt
192.168.230.1 | 110/tcp  filtered pop3   | 554/tcp  filtered rtsp    | 1863/tcp filtered msnp  | 7070/tcp filtered realserver
192.168.234.1 | 554/tcp  filtered rtsp   | 1863/tcp filtered msnp    | 3306/tcp filtered mysql | 7070/tcp filtered realserver

Here is what I know about this modem:

• It is a CPE by vodafone for use in europe (italy, germany) and NZ marketed as Vodafone Station Revolution or EasyBox 804 (altough this has a different fw from mine).
• Extremely dumbed down web interface implemented as a plugin to Jungo (now Cisco) OpenRG 5.4 (Side question: the linux binaries look like they are from 2005. Is there any known exploit i should be aware of for this version of OpenRG?).

Can the community help me investigate the purpose of these open ports? I think it may be a possible security issue.

Answer 1

Those are ports used in "media" servers- RTSP and realserver are streaming protocols, 1863 is a Microsoft notification protocol. Napster was for file sharing, etc.

Having the router listening on these ports on all internal networks isn't necessarily problematic, though the presence of ancient protocols like realserver and napster is certainly suggestive of age and therefore by implication of security issues.

The two things to look further into are:

• what ports if any are open on the external interface?
• can services listening on internal and external ports be disabled in configuration?

Going through configuration and disabling everything possible to disable should result in there being no listening ports on the external interface and no listening ports except for http (or https) on the internal interface.

There may still be security issues with the internal http port, of greater or lesser difficulty to find. It should be much faster to determine if the minimal level of assurance that unnecessary ports are closed can be achieved. If that level of assurance cannot be achieved then it goes without saying that there will be vulnerabilities on those unnecessarily open ports.