TP-Link Easy Smart Switch security question
-
I have the TL-SG105E v5 with a firmware from 2019 that came when I ordered it a few weeks ago. I have tested thoroughly and can confirm that the management interface is actually available on all VLANs, even if the port is unchecked from VLAN1 completely.
-
@vasko said in TP-Link Easy Smart Switch security question:
that the management interface is actually available on all VLANs, even if the port is unchecked from VLAN1 completely.
That is not very secure now is it ;)
-
I am trying to modify the TL-SG108E v1 to get the firmware from v3 or v4 working on v1. v1/2/3/4 they are identical except for the amount of memory, the v1 carries a 1 Megabyte GD25Q80 GigaDevice flash while the v2/3/4 carries a 2 Megabytes GD25Q16. Firmwares from v2 ownwards cannot be flashed to v1 just because of the amount of memory available (firmware from v2 occupies 0.98Megabyte, v3 or v4 occupies 1.05 Megabytes).I'm going to replace the flash memory from v1 with a GD25Q16. I will read the current flash memory, and introduce the firmware of v3 or v4.The memory layout is as follows:
0x0: Bootloader
0x1000: Firmware
0xFC000: MAC address
0xFF000: ConfigurationI intend to read the original flash, and modify from 0x1000 onwards by writing the firmware of v3/4 but it would exceed (due to its size) the 0xFC000 offset so the MAC address would be overwritten. In the v2/3/4 flash layout the MAC address must come in another offset, but I don't know which one. Nor do I know for sure if the MAC address is read from that offset by the bootloader or the firmware itself. In the first case, you should also modify or replace the bootloader.I am using a CH341a Mini Programmer with test clips (shorturl.at/abFI4) to read the flash without desoldering it.If someone has a TL-SG108E v2/3/4 and has a flash memory programmer, could you dump the memory and send it to me privately to investigate? Of course you must find your MAC address in the dump and modify it for example by 00:11:22:33:44:55 to be able to locate it.Thanks you very much for your collaboration.Not possible, v1 have a different Realtek chip than v2/v3. Instead, it can be crossflashed to Netgear GSS108E.
But it is possible to flash v3 firmware in v2. These are identical and v3 firmware allows to modify VLAN1.
-
I have managed to crossflash from TL-SG108E v1 to Netgear's GSS108E. Both have an RTL8370N chip.
The GSS108E is also a manageable 8-port switch with same chip and same flash memory as TP-Link v1 (1MB) and with a web interface. Also allow you to edit VLAN1. It also comes with two power-only USB ports for charging smartphones. But the Switch part is exactly the same and it doesn't affect anything.
You need the CH341a Mini Programmer and of course don't forget to make a backup of the flash. Read at least twice and check md5 of dumps to make sure it doesn't contain errors. Here are the steps to convert the TL-SG108E into a GSS108E.
1.- Create an empty 1MB file for v1 with hex editor and fill it completely with FF.
2.- Download the GSS108E bootloader from the Netgear website, it's included in the download of firmware version 1.0.0.10. Also download the latest firmware version (v1.6.0.4).
3-. Open the loader file with hex editor and select all content. Copy and paste it by writing (not inserting) from beginning (0x0) into the empty file you created before.
4-. Write the original MAC address at offset 0xFC000 and save the changes.
5.- Write the file in the flash with CH341A Mini Programmer (don't forget to check writed content).
6.- Turn on the Switch, connect your PC to any port and configure the network in 192.168.0.x/24.
7.- Open the browser and access the Switch (the default ip is 192.168.0.239). The bootloader recovery web will appear. Select the firmware v1.6.0.4 and flash. After a minute or two the Switch will reboot and you will be able to access its configuration.
Advantages over TP-Link firmware:
- Configuration web in TL-SG108E v1
- You can modify VLAN1, leave it without any port and even delete it.
- You can disable the configuration with the Netgear ProSAFE Plus Utility tool, which will prevent the Switch from being discovered by broadcast packets.
Problem (only cosmetic):
The port LEDs do not work as with original firmware. In Gigabit Ethernet mode, the LED that lights up is orange instead of green, and in Fast Ethernet mode is green instead of orange (leds are inverted).
All everything else works correctly as expected.
-
I have a TL-SG108E v2 on the way. I can upload a dump of the flash with the v3 firmware installed. In case anyone is interested.
-
Hi!
I’m new to this forum, so sorry to immediately open my first post with a request.
I would need a TL-SG108E V3 GD25Q16 flash chip for full content because I didn't save my own (: (: and the switch became a brick.
Thank you very much if anyone can help!
Hi: Fazon -
@fazon Here is the dump of the v3 flash with the latest version. You must edit the MAC address found at offset 0x1FC000 (filled in with "AA BB CC DD EE FF") for the one below on the Switch label.
https://www.mediafire.com/file/tpplnk69b6g5scw/TL-SG108E_v3_AABBCCDDEEFF_dump.bin/file
-
Hi friend!
You helped a lot, thank you very much!
Have good health and have a nice day!
wbr.
Fazon -
I have the TL-SG105E v5 with a firmware from 2019 that came when I ordered it a few weeks ago. I have tested thoroughly and can confirm that the management interface is actually available on all VLANs, even if the port is unchecked from VLAN1 completely.
Exact same issue on the TL-SG108E v5. Config:
-> management Interface is still accessible on Ports 2-8. -
Yeah I really would just use those as dumb switches.. I put mine into use the other day.. just dumb.. The 2 devices I have plugged into same vlan.. That control upstream of that switch via cisco sg300..
I had a netgear I was going to use instead.. But ports wouldn't light up..
-
This post is deleted! -
@apocalypse I know that you created this over a year ago, but still, Have to say after finding and reading this just now, I am impressed and greatful that you have already gone through the work to do this. I have been doing my own research on this switch. has I have a few of them that I took home after replacing 3 of them at a Clients, and I want to repurpose them for a budget project I am working on for a friends Business, and I discovered the Major Flaw with the Security (All 3 of mine are TL-SG108E v1's, and all of them have that same flaw where you can access the management page, no matter what VLAN I isolate the port too. Of course I was just going to replace the switches outright with something new, but because I need 3 Small 8 Port Switches at different locations throughout the massive building, and he doesn't have the budget to get wiring done the way it should have been done in the first place, I would prefer to just make these essentially free switches work correctly.
So I was researching modifying the config file, when I just happened to come across your post. I already am familiar with the CH341a Mini Programmer, as this is what I use to flash "Bricked" Motherboards and GPU's for Clients. It will be a pretty simple matter to flash the Memory with your very detailed Instructions. I really thank you for that. Will be working on flashing all 3 this weekend and will try to remember to report back to show that I can now Make it so that the ports I don't want to have access to management, don't.
Thank You!
-
@mattthetechlv said in TP-Link Easy Smart Switch security question:
I can now Make it so that the ports I don't want to have access to management, don't.
Are you using them as dumb and all just in 1 vlan, and you just want to prevent access to the gui..
Because while it is a security issue - its a bit more than just access to the admin gui :)
That they thought they could just leave every port in vlan 1, and let other ports be in other vlans is just beyond crazy.. How this got through any sort of review is just beyond crazy. I really wouldn't trust that company with anything other than a dumb switch..
-
@johnpoz I agree, it is insane how this ever got past their Design team. Not the biggest TP-Link fan myself, just trying to make something happen with no budget as a favor to a friend. If this works as I hope it will, I intend to carry Multiple VLAN's to different ends of the property, going to these switches downstream in 3 different areas. 4 VLAN's Total. I have my management VLAN already sectioned off and am not sending that VLAN to any of these switches, I just didn't want anyone to be able to plugin to any empty ports on any of these switches to be able to reconfigure, as some of my friends employee's think they are smart, so I am just trying to avoid as much as possible. I am hoping with the Netgear firmware flashed onto these devices it will neutralize the security threat of VLAN's leaking over.
The Only Port that I will keep VLAN 1 Open on will be Boxes that I and my friend only have credentials too, so as long as no one switches ports out on me (And I intend Locking the switches behind a locked Cage to discourage this) it should be sufficient, as long as this firmware solves the VLAN Crosstalk issues. Not too impressed with Netgear either Mind you, but I have used the GSS108E as a cheap solution in the past and didn't have any VLAN related Security Issues, so I am hopeful this will work. Will find out soon enough though.
Is there some other Security Issue other than the VLAN Crosstalk/(Not being able to remove VLAN 1 Tags From Ports) that I should be aware of with this switch?
-
Not that I am aware of - if you can fix their firmware to allow removal of vlan 1 from ports it shouldn't be on.. You should be ok.. I validated that their firmware they released for v3, and also works on v2 even though they never said it would, did allow for removal of vlan 1.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.03 | Lab VMs 2.7.2, 24.03 -
@johnpoz OK Good to know. Yeah, If I had Version 2's I would just go that route, unfortunately I am stuck on Version 1, and unfortunately there is not enough room on the Flash to write the V3 to (V1 only has 1MB of Onboard Flash, and the V2 Firmware file size is much bigger than 1MB.)
Thats why I was happy to find @Apocalypse Post above. He Details successfully flashing Netgear's GSS108E's Firmware onto the TP-Link TL-SG108Ev1, and because both Model's Use the same Hardware internally, it actually works well according to @Apocalypse . It looks like the only issues he noticed were that the Lights Flash the Wrong Color (Gb Flashes Orange instead of Green), but in this case that doesn't bother me at all. And Most Importantly, while he doesn't flat out say that you can't access management when you remove VLAN1, He Does say that you can remove VLAN 1 (Just like you can on the GSS108E), so it leads me to believe it will solve the issue, and for me its not hard at all to do as I already have the ROM Flasher, and am familiar with editing Firmware's to swap out MAC Addresses already (As this is also what you have to do when Recovering Bricked Motherboard's and GPU's). Also, just to double check, while at a clients yesterday that has a GSS108E on site that wasn't in use I hooked it up and played with it for a bit and confirmed that when you remove VLAN 1 from a Port, you can no longer access the Management, either from the Netgear Easy Config Software or from the Web Interface, so as long as it works that way when flashed on the TP-Link, it should be all good.
Anyways, I have written enough already, sorry for talking so much. I will test this out either tomorrow or Sunday, and will report back here to let everyone know if this worked for me as well. If it does, it should give V1's a longer lease on Life, without having to deal with the pain of editing Config Files. (I know some would consider this more painful, but in my opinion this is actually much less painful because you only have to deal with the editing of the Firmware and flashing once, after that all Config can be done through normal means, and you don't have to edit a Config file every single time you want to make a VLAN Change, so I definitely much prefer this route personally.)
Anyways, I will shut up now.
-
Thanks for the info dude.. I have been known to throw out some books of posts myself.. So yours is really short to be honest ;)
Looking forward to hearing how it turns out.. Good luck with the project.
-
@mattthetechlv said in TP-Link Easy Smart Switch security question:
I hooked it up and played with it for a bit and confirmed that when you remove VLAN 1 from a Port, you can no longer access the Management
You can access the management from any VLAN, which is why I returned both my V5 and V6.
-
@thiasaef Right, this is true with the Stock Firmware. I am doing what @Apocalypse did above and Flashing my V1 With Netgear's GSS108E's Firmware (The Netgear switch runs the same exact Hardware under the hood as the V1). What you quoted me saying above was in relation to me checking the Netgear GSS108E at a clients earlier today and confirming that it does not in fact suffer from the same problem that the TP-Link TL-SG108E does. This means if @Apocalypse is correct (and considering his detailed write up above I am inclined to believe him) and I can easily flash the Netgear GSS108E Firmware onto the TL-SG108E, then its likely this firmware will take care of that stupid VLAN Bug. Will let you guys know how it works for me tomorrow.
Also, appreciate the kind words @johnpoz !
-
i have two V2.0s, is there any reason to reflash them to the GSS108E firmware as the above poster has accomplished ? some people say that the GSS108E doesnt even have a webgui, you have to use their tool ??? i don't care that the management interface is accessible via any VLAN really, but the webgui does seem weird on these
