RW21: Recover password from epassword value

Question

Hi Team,

I have a Digi TransPort WR21. I have the current config file which includes the usernames and epassword of three different users created back in time.

I have tried to find how I could recover the plaintext password from the epassword value.

I believe it's not encrypted but only "enciphered" according to some documentation I read. The thing is that I'm not able to find how the epassword value is created from the plaintext password.

I.e. one of the users in my config file is the default username:password which is coming like:

user 1 name "username"
user 1 epassword "KD5lSVJDVVg="
user 1 access 8

The algorithm used to create the epassword value seems to be the same for all other devices. I concluded it because in this document (http://ftp1.digi.com/support/documentation/AN_009_Using_IPSec_over_a_mobile_network_with_a_Cisco_Router.pdf) the epassword value for username "username" is the same than in my case. (whose plaintext value would be "password").

Could you please give a hint how I could reverse the password and/or crack it?

I need to recover it to have access to the device.

Thank you very much in advance,
Carlos

Answer 1

if you want to reset the password connect via serial and change it

regards

james

Comments

Hi James,

Thanks a lot for replying.

I still would like to know how the epassword value is calculated. I don't see it documented anywhere and I think it's a critical point when it comes to security.
Could you please provide more information about it?

With regards to serial port, currently I don't have a cable here. Maybe I could try to connect it using a RS-485 cable that I have. Do you have instructions how to connect using RS-485 cable? I tried to do so and the console didn't response at all.

Thank you very much in advance,

Carlos

---

I'm not sure of the answer to your epassword question right now, but I can tell you that you should use a regular, straight through serial cable to interface with the TransPort's serial port in (RS-232 mode) since it's a DCE (not DTE) serial port, and connect at 115,200 baud.

Answer 2

Sorry, this is not something we will help with or discuss on the forum.
The password should be reset from the CLI using a serial cable and terminal session or by logging into the router with a valid username and password then changing the password that is forgotten.

Regards,
Ben
Tech Support