# Hidden Backdoor in Digicom Router?

In this article, let us take a close look into the Digicom router DG-M342T. First, let us view the technical specifications of the router. It's a 2.4 GHz router with 1 WAN Port and 4 LAN Port. Nothing fancy, but it's a decent router for use as a secondary Wi-Fi router.

The box of the router points to the official website i.e. digicom.com.hk. Upon opening the website, we are greeted with this maintenance screen.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696687389773/e18c1208-e786-4222-b672-f7153de90069.png align="center")

Performing some background checks on the website via archive.org, it is found that the website has been in maintenance mode since 2016. So we are not off to a good start here.

Looking into the router setup page of the router, the pages are a close resemblance to that of dlink router. Initially, I thought that this router might be running modified firmware of dlink router. This claim was kind of verified when I found a javascript file "menu.js" on the page, the js code had a function openSupport() that opens D-Link's website.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696689074690/ce623388-e7d8-401d-834d-5339a9d7f5de.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696689119349/f0864e79-9cfe-457a-a473-b749c44308a2.png align="center")

While checking the router page, I found an interesting page that was accessible without login i.e. "status.htm" which gave some basic information about the router.

Looking further and deeper into the router, I came across telnet enable/disable page of the router

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696689804843/bc6d6dfb-7c87-4345-9910-cdac41a1513a.png align="center")

I enabled it and performed a quick port scan to verify that the port was open.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696689973177/7b618bb1-d2f3-43bc-8d66-b4bce2d79d47.png align="center")

Then, I tried to connect to the telnet using the router credentials that I had set via the setup page. It worked and I was in.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696690103899/dd362a04-5d2c-4cdb-bfe1-3846590a51f3.png align="center")

The list of available commands inside the telnet session was as follows:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696690173799/a3abf238-684d-4b0e-b2e0-d03915f37b72.png align="center")

Most of the commands were for providing debug information. The particular command that piqued my interest was "login". Upon running the command I found out that, it accepted arguments.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696690387692/a3656986-2ea5-4f14-9a5d-e140cdd0ffe9.png align="center")

I was interested in the show argument and I ran it. To my surprise, instead of it showing a single account detail I set on the router, it showed two accounts: one that I set and another one which probably is a backdoor account. What seems even more interesting is that the priority of the account is higher than that of my own.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696690687640/37fc3cb9-08cc-4e7f-b1d1-9a1579f19146.png align="center")

I opened a new terminal and try to telnet to the router using the new credentials i.e. admin:3EF4airocon. The login was successful. Upon login, I immediately noticed that the list of commands this account could access was higher than that of a normal account.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696691024760/3bd8108c-04f3-4309-9e12-1355dd0f0bab.png align="center")

I also tested the credentials on the router setup page.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696691142774/3f8adb39-8a97-488a-9749-7a4193581f67.png align="center")

But instead of it working like a normal account, I landed on a 404 page.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696691196226/bcb130d8-175d-47d9-b734-389ad01e14f5.png align="center")

Even the login page was no longer accessible

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696691256431/8667b612-e7df-49a2-ad96-ef9003202b52.png align="center")

The page was inaccessible even via curl.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696691402912/4ae4ce3b-8130-49cf-86f2-cf76a82971f2.png align="center")

With no other choice, I had to restart my router to restore it back to the previous working state.  
In conclusion, the particular digicom router seems very suspicious and full of suprises. From the official website to the backdoor account, everything about the router seems pretty eccentric. With this blog, I hope to raise some awareness among the users of Digicom routers.