Hacker News Reader

My money is on "hardcoded admin backdoor password leaked".

Edit: Found the manual[1]

"Changing a User’s Password: When viewing details about a user, the Administrator can change the user’s password (no password is the default setting)."

Oof.

[1] https://media.flixcar.com/f360cdn/Western_Digital-905161691-...

View on HN

Alternatively - a backdoor without any authentication requirements at all was discovered.

There have been times when web crawlers have found pages with delete icons on them that are pointing to GET requests and, after dutifully following them to index the data, resulted in a server being wiped.

Anyone got a link?

> My money is on "hardcoded admin backdoor

Mine are on UPnP and shitty firmware web server

Reply on news.ycombinator.com