Posted by Jon Hart on Dec 23

At least on the pile of RomPager 4.01 devices that I have access to,
they use straight HTTP authentication by default and do not use any
cookies from what I can see. That’s not to say that there isn’t
cookie handling code exposed in some way. It is also possible that
these devices have already been patched against this vulnerability and
the version was unchanged, or that they are so highly customized that
the vulnerability is…