I'm studying Info Security and was poking around my home router (it's a cheap one) with a python script trying to brute force the admin password for the web interface (it uses HTTP basic and the server is micro_httpd).
I discovered that when passing the auth header in with the initial request I was able to bypass the rate limiting feature on the router and hit it with 10k / min requests no problem, eventually getting the password out.
Does this sound like a genuine vulnerability worth a report or this to be expected of this level device?
Its the kind of router that might be in use at cafe hotspots and the like so I could easily see how it could be exploited if people use a reasonably weak password for the admin interface.