APC Back-UPS HS 500 unprotected web interface access

[Anonymous user]

Hello!

I just bought APC Back-UPS HS 500 and I have problem with web interface.
IP address is assigned through DHCP.
When I access web interface there is login prompt and I can login with default username and password.

Problem is when I access web interface and don't enter password I can se all web pages without any login prompt.
I can access STATUS, CONFIGURATION, MAINTENANCE and what is worse ABOUT page where there is information like MAC address and serial number.

It is huge security risk because anyone could access that info and get backdoor credentials
from your forum at https://community.exchange.se.com/t5/APC-UPS-for-Home-and-Office-Forum/bd-p/home-office-forum !???

- Firmware revision: l1
- Web firmware revision: l5
- UPS date of manufacture (mm-dd-yyyy): 10-29-2010
- Battery replacement date (mm-dd-yyyy): 10-29-2010

Please help, thank you!

Greetings from Croatia.

Mladen Santic

[BillP · Accepted solution]

i didnt realize that was possible since i dont work with that product often but the product only supports access from the local subnet, you cannot put it on the internet. that still can be a risk i understand though. not sure if anyone else has any comments on that?

does it do it by hitting the back button where the credentials are being cached?