=============== PROBLEM DESCRIPTION ==================

The CGI /cgi-bin/firmwarecfg, when executed, checks the existence of the file fw_ip under /var/tmp/. If this file exists, all IP addresses listed inside it are given straight access to the device, without the need for authentication. If this file doesn't exists, the CGI creates a new one, putting the requesting address inside.

If the web configuration console is accessible from internet
and if nobody have never called the CGI before (es: from a workstation
inside the LAN), then everybody can gain access to the router,
download the config.xml file which contains users account and passwords,
have access to the private network, modify or alter the firmware of the
router, etc.

=================== FIX INFORMATION ===================

Actually there is no solution to problem due to the fact that
it seems an hidden feature.
The work around is to call the CGI /cgi-bin/firmwarecfg from a
known address of the local network and/or disable web console access
from the internet.


Ну и чего скажете???
Новость взята с наг.ру
http://forum.nag.ru/viewtopic.php?t=12822

К сожалению сие правда, НО это действует только из LAN сигмента, извне к Вам доступ получить никто не сможет, сейчас ведутся работы по устранению данной проблемы