Accessing a router's configuration via an HTTP URL demonstrates which vulnerability?

Accessing a router's configuration via an HTTP URL demonstrates which vulnerability?

• A. HTTP Configuration Arbitrary Administrative Access Vulnerability
• B. HTML Configuration Arbitrary Administrative Access Vulnerability
• C. URL Obfuscation Arbitrary Administrative Access Vulnerability
• D. Cisco IOS Arbitrary Administrative Access Online Vulnerability

Answer: (A)

Accessing a router’s configuration through HTTP shows that the management interface is exposed over an unsecured web channel, allowing administrative actions to be performed via a URL. If the HTTP interface isn’t properly protected—lacking strong authentication, authorization controls, or using default credentials—an attacker could reach the configuration pages and changes could be made without proper safeguards. This situation is described as an HTTP Configuration Arbitrary Administrative Access Vulnerability, highlighting that the risk comes from using HTTP (not secure) to perform arbitrary admin actions on the device. Other options don’t fit as precisely. An HTML configuration vulnerability would focus on issues with HTML content itself rather than the transport method or access control of the web interface. URL Obfuscation vulnerability concerns tricks that mislead users about a URL’s true destination, not direct unauthorized configuration access. A Cisco IOS Arbitrary Administrative Access Online Vulnerability is overly specific to a vendor’s IOS and a particular implementation, whereas the scenario points to the general risk of admin access over HTTP.

Accessing a router’s configuration through HTTP shows that the management interface is exposed over an unsecured web channel, allowing administrative actions to be performed via a URL. If the HTTP interface isn’t properly protected—lacking strong authentication, authorization controls, or using default credentials—an attacker could reach the configuration pages and changes could be made without proper safeguards. This situation is described as an HTTP Configuration Arbitrary Administrative Access Vulnerability, highlighting that the risk comes from using HTTP (not secure) to perform arbitrary admin actions on the device.

Other options don’t fit as precisely. An HTML configuration vulnerability would focus on issues with HTML content itself rather than the transport method or access control of the web interface. URL Obfuscation vulnerability concerns tricks that mislead users about a URL’s true destination, not direct unauthorized configuration access. A Cisco IOS Arbitrary Administrative Access Online Vulnerability is overly specific to a vendor’s IOS and a particular implementation, whereas the scenario points to the general risk of admin access over HTTP.