Menu
Reply
ALF28
  • 982
  • 18
  • 104
Well-informed
1,557 Views
Message 1 of 79
Flag for a moderator

TR-069 PROTOCOL

Following an earlier post on a different subject (Re: WIFI OPEN DURING START UP)

The issue has not repeated but connects first and then  secures, sometimes delayed.

I did a router check and found a vulnerability that was not here before, first time I have seen this from my regular check so is a new security issue just appeared.

TR-060 PROTOCOL

PORT 7547 OPEN

this may give access to hackers??

why has this port opened and should it be open.

extract from advice on internet-

If you are not vulnerable, but port 7547 is open on your router, we recommend that you:

  • Reboot your home router immediately. You may suffer from other port 7547 vulnerabilities.
  • Upgrade your router firmware if you can.
  • Close port 7547 on your router if you can. (Many routers don’t allow this)
  • Contact your ISP and let them know that port 7547 on your home router is accessible from the public internet. Let them know that port 7547 is used by your ISP to manage the router. It should not be publicly available. Suggest that they filter access to that port to prevent anyone on the public internet accessing it.

please advise if i need to reboot the hub and any other actions if needed??

Do I need to change any passwords.

I have looked at older posts on protocol tr-069 but concerned about the open port 7547 which is used to make changes to the router, is virgin keeping this port open, can  it be closed on the hub3 or does it need to remain open.

alf28

0 Kudos
Reply
ALF28
  • 982
  • 18
  • 104
Well-informed
1,534 Views
Message 2 of 79
Flag for a moderator

Re: TR-069 PROTOCOL

extra info

my ip addess changed recently-segmentation may be connected to port open issue?

can not log into my hub settings at present it says someone else logged in- need to check port settings will try later.

0 Kudos
Reply
ALF28
  • 982
  • 18
  • 104
Well-informed
1,530 Views
Message 3 of 79
Flag for a moderator

Re: TR-069 PROTOCOL

should I reboot hub3 now??? will await feedback first.

alf28
0 Kudos
Reply
ALF28
  • 982
  • 18
  • 104
Well-informed
1,512 Views
Message 4 of 79
Flag for a moderator

Re: TR-069 PROTOCOL

PERHAPS TIME TO GET MY OWN ROUTER????

no help yet from community  so will reboot  my hub3,

must have been hacked, as I can not enter the settings page unless virgin have done something with my hub3 says already open by someone else????

cleaned browser and switch pc off and tried again still says settings page opened by another person and checked all computers not open.

this happened a few years back when virgin swopped my ip address and had trouble  with back doors in my hub.

It may be they swopped me to a bad ip address as it is blocked on baracuda for spam

Problems occur due to changes by virgin???  my computers are clean with virus scans, the hub is acting strange lately.

looks like a hacker has used my new ip address to do something to my hub and also lock me out of the settings  page???

I will reboot the hub now, as no response from the community???  I will do the nuclear option and see if it cures the problems.

anybody know of a cheap router that   that will work  with the virgin hub3, have tried tp-link's not compatible with virgin hub3

not happy, history repeating.

alf28

 

 

0 Kudos
Reply
Anonymous
Not applicable
1,505 Views
Message 5 of 79
Flag for a moderator

Re: TR-069 PROTOCOL

there are no back doors in the hub.

Paranoid much
0 Kudos
Reply
ALF28
  • 982
  • 18
  • 104
Well-informed
1,502 Views
Message 6 of 79
Flag for a moderator

Re: TR-069 PROTOCOL

apcyberax

Yes true  I am a bit paranoid but not without reason, so why today can I not get into setting page for hub3??, locked out so  that is unusual, is the page currently down??  

What is port 7547 and why  open to public. Not had this before.

Never had this before in several years, so unusual unless virgin have an explanation, other than I am paranoid or unless virgin are working on the system.

Seems the community have no answers to this one so reboot may be worth  a try.?

You have  been very helpful  recently so I thank you for that it is much appreciated.

Any advice on best router to function with hub3 in modem mode, I may consider that.

Only a reboot can get me back into hub settings?  or can virgin unlock my page, has the password changed.

alf28 

 

 

 

0 Kudos
Reply
Anonymous
Not applicable
1,498 Views
Message 7 of 79
Flag for a moderator
Helpful Answer

Re: TR-069 PROTOCOL

"I am a bit paranoid but not without reason, so why today can I not get into setting page for hub3??, locked out so that is unusual"
Are you using the virgin connect app on any phone or device? If so uninstall it and factory reset .the hub

What is port 7547 and why open to public? Not had this before.
No reason i would say the site you used to scan for open ports detected a false positive
ALF28
  • 982
  • 18
  • 104
Well-informed
1,492 Views
Message 8 of 79
Flag for a moderator

Re: TR-069 PROTOCOL

Thanks for this help,

Are you using the virgin connect app on any phone or device? If so uninstall it and factory reset .the hub

Settings page problem- I can confirm no virgin connect app on my tablet at present, I have checked that and do not have a smartphone and all browsers checked & closed on computers, so a puzzle

Will do a hub factory reset, as advised and see if things return to normal.

Hopefully that will sort it. Saved me a phone call on150, so grateful for the community good help as usual

alf28

 

0 Kudos
Reply
ALF28
  • 982
  • 18
  • 104
Well-informed
1,482 Views
Message 9 of 79
Flag for a moderator

UPDATERe: TR-069 PROTOCOL

UPDATE-factory reset done and back online-all done.

back into hub settings page at last and did my chosen settings. ALL LOOKS OK

hub 3 open port  may be a false positive but still remains there on hub3 router check, or may be a valid port.

After reboot of hub, an unusual intrusion  incoming form the network, blocked by my firewall after the reboot -not sure what it was so blocked it & returned it.

alf28

 

 

0 Kudos
Reply
ALF28
  • 982
  • 18
  • 104
Well-informed
1,422 Views
Message 10 of 79
Flag for a moderator

Re: UPDATERe: TR-069 PROTOCOL

What is port 7547 and why  open to public

This port remains open and not sure of why, any of the port check tool can be used to show it is open.

Has Anyone else got this on their hub- that would prove it is normal to have this port open???

may be used by virgin for communications with hub??

 

TR-069 protocol allows ISPs to manage modems remotely. Port 7547 has been assigned to this protocol.

past reports-

First of all, let’s take a look at the changes made to the attack module recently. Currently, the ATK (attack) module supports three different attack methods which help to propagate the worm on different IoT devices:

  1. TR-069 exploitation;
  2. Telnet default password attack;
  3. Arris cable modem password of the day attack.

Of these three attacks, the TR-069 exploit dates back to 2016, implemented  by the attackers 2017

A the port 7547 remains open just hope this old exploit is no longer a threat. 

I recently could not get into hub settings and had all the trouble  of rebooting my hub to get my settings page back, it was locked out.

alf28

0 Kudos
Reply