Zack Fasel

The issue allows remote attackers to gain administrative access due to a default password for the `mso` account. This default password is 'D0nt4g3tme'. Attackers can exploit this via the web interface or TELNET interface.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the web interface. These vulnerabilities allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that perform a login via "goform/login". Additionally, attackers can hijack the authentication of administrators for requests that enable external logins via an "mso remote enable" action to "goform/RemoteRange" or change DNS settings via a "manual dns enable" action to "goform/Basic".

The issue concerns the web management portal of the affected device, which uses predictable session IDs based on time values. This predictability makes it easier for remote attackers to hijack sessions via a brute-force attack on the `userid` cookie.