# Exploit Title: Password Disclosure vulnerability
# Software: NETGEAR DGN2200
# Software Link: netgear.com
# Version: DGN2200
# Author: Dolev Farhi, email: dolev(at)openflare(dot)org
# Date: 23.7.2014
# Tested on: Kali Linux
# Firmware 1.0.0.29_1.7.29_HotS
2. Vulnerability Description:
===============================
An attacker is able to extract sensitive information such as the password from the Basic Settings router page due to storing it in plaintext.
3. Steps to reproduce:
======================
Navigate to the Basic Settings page, right click in the browser -> view source/frame
html>
<head>
<META name="description" content="DGN2200v2BEZEQ">
<META http-equiv="Content-Type" content="text/html; charset=utf-8">
<META http-equiv="Content-Style-Type" content="text/css">
<META http-equiv="Pragma" content="no-cache">
<META HTTP-equiv="Cache-Control" content="no-cache">
<META HTTP-EQUIV="Expires" CONTENT="Mon, 06 Jan 1990 00:00:01 GMT">
<title>PPPoE</title>
<link rel="stylesheet" href="form.css">
<STYLE TYPE="text/javascript">
classes.num.all.fontFamily = "Courier";
classes.num.all.fontSize = "10pt" ;
</style>
<script language="javascript" type="text/javascript" src="func.js"></script>
<script language="javascript" type="text/javascript" src="msg.js"></script>
<script language="javascript" type="text/javascript" src="utility.js"></script>
<script language="javascript" type="text/javascript" src="browser.js"></script>
<script language="javascript" type="text/javascript" src="md5.js"></script>
<script language="javascript" type="text/javascript">
var DisableFixedIP = false;
var DisableFixedDNS = false;
var all_wan_proto = new Array(8);
var all_pppoe_localip = new Array(8);
var all_wan_dns_sel = new Array(8);
var all_wan_dns1_pri = new Array(8);
var all_wan_dns1_sec = new Array(8);
var all_wan_nat = new Array(8);
var all_wan_fw = new Array(8);
var all_ppp_dod = new Array(8);
var all_pppoe_idletime = new Array(8);
var all_pppoe_username = new Array(8);
var all_pppoe_passwd = new Array(8);
var all_pppoe_servicename = new Array(8);
var all_is_static_ip = new Array(8);
var all_wan_isbridge = new Array(8);
function loadMultiWanInfo()
{
var cf = document.forms[0];
cf.adslChoice.selectedIndex = cf.nowchoice.value;
all_wan_proto[0] = "pppoe";
all_wan_proto[1] = "pppoe";
all_wan_proto[2] = "pppoe";
all_wan_proto[3] = "pppoe";
all_wan_proto[4] = "pppoe";
all_wan_proto[5] = "pppoe";
all_wan_proto[6] = "pppoe";
all_wan_proto[7] = "pppoe";
all_pppoe_localip[0] = "ip.add.re.ss";
all_pppoe_localip[1] = "0.0.0.0";
all_pppoe_localip[2] = "0.0.0.0";
all_pppoe_localip[3] = "0.0.0.0";
all_pppoe_localip[4] = "0.0.0.0";
all_pppoe_localip[5] = "0.0.0.0";
all_pppoe_localip[6] = "0.0.0.0";
all_pppoe_localip[7] = "0.0.0.0";
all_ppp_dod[0] = 0;
all_ppp_dod[1] = 0;
all_ppp_dod[2] = 0;
all_ppp_dod[3] = 0;
all_ppp_dod[4] = 0;
all_ppp_dod[5] = 0;
all_ppp_dod[6] = 0;
all_ppp_dod[7] = 0;
all_pppoe_idletime[0] = 0 / 60;
all_pppoe_idletime[1] = 0 / 60;
all_pppoe_idletime[2] = 0 / 60;
all_pppoe_idletime[3] = 0 / 60;
all_pppoe_idletime[4] = 0 / 60;
all_pppoe_idletime[5] = 0 / 60;
all_pppoe_idletime[6] = 0 / 60;
all_pppoe_idletime[7] = 0 / 60;
all_wan_dns_sel[0] = "0";
all_wan_dns_sel[1] = "0";
all_wan_dns_sel[2] = "0";
all_wan_dns_sel[3] = "0";
all_wan_dns_sel[4] = "0";
all_wan_dns_sel[5] = "0";
all_wan_dns_sel[6] = "0";
all_wan_dns_sel[7] = "0";
all_wan_dns1_pri[0] = "80.179.52.100";
all_wan_dns1_pri[1] = "";
all_wan_dns1_pri[2] = "";
all_wan_dns1_pri[3] = "";
all_wan_dns1_pri[4] = "";
all_wan_dns1_pri[5] = "";
all_wan_dns1_pri[6] = "";
all_wan_dns1_pri[7] = "";
all_wan_dns1_sec[0] = "80.179.55.100";
all_wan_dns1_sec[1] = "";
all_wan_dns1_sec[2] = "";
all_wan_dns1_sec[3] = "";
all_wan_dns1_sec[4] = "";
all_wan_dns1_sec[5] = "";
all_wan_dns1_sec[6] = "";
all_wan_dns1_sec[7] = "";
all_wan_nat[0] = "1";
all_wan_nat[1] = "1";
all_wan_nat[2] = "1";
all_wan_nat[3] = "1";
all_wan_nat[4] = "1";
all_wan_nat[5] = "1";
all_wan_nat[6] = "1";
all_wan_nat[7] = "1";
all_wan_fw[0] = "1";
all_wan_fw[1] = "1";
all_wan_fw[2] = "1";
all_wan_fw[3] = "1";
all_wan_fw[4] = "1";
all_wan_fw[5] = "1";
all_wan_fw[6] = "1";
all_wan_fw[7] = "1";
all_pppoe_username[0] = "user@012ISP";
all_pppoe_username[1] = "";
all_pppoe_username[2] = "";
all_pppoe_username[3] = "";
all_pppoe_username[4] = "";
all_pppoe_username[5] = "";
all_pppoe_username[6] = "";
all_pppoe_username[7] = "";
all_pppoe_passwd[0] = "MyPassword"; <--- password
all_pppoe_passwd[1] = "";
all_pppoe_passwd[2] = "";
all_pppoe_passwd[3] = "";
all_pppoe_passwd[4] = "";
all_pppoe_passwd[5] = "";
all_pppoe_passwd[6] = "";
all_pppoe_passwd[7] = "";
all_pppoe_servicename[0] = "";
all_pppoe_servicename[1] = "";
all_pppoe_servicename[2] = "";
all_pppoe_servicename[3] = "";
all_pppoe_servicename[4] = "";
all_pppoe_servicename[5] = "";
all_pppoe_servicename[6] = "";
all_pppoe_servicename[7] = "";
all_is_static_ip[0] = "0";
all_is_static_ip[1] = "0";
all_is_static_ip[2] = "0";
all_is_static_ip[3] = "0";
all_is_static_ip[4] = "0";
all_is_static_ip[5] = "0";
all_is_static_ip[6] = "0";
all_is_static_ip[7] = "0";
all_wan_isbridge[0] = "0";
all_wan_isbridge[1] = "0";
all_wan_isbridge[2] = "0";
all_wan_isbridge[3] = "0";
all_wan_isbridge[4] = "0";
all_wan_isbridge[5] = "0";
all_wan_isbridge[6] = "0";
all_wan_isbridge[7] = "0";
}
function goTestApply()
{
var winoptions = "width=640,height=480,menubar=yes,toolbar=yes,status=yes,location=yes,resizable=yes";
if(document.forms[0].runtest.value == "yes")
openDataSubWin('wtest.htm',winoptions);
}
function ChangeAdslChoice()
{
var cf = document.forms[0];
var index = cf.adslChoice.selectedIndex;
var wan_proto = all_wan_proto[index];
if (wan_proto == "dhcp" || wan_proto == "ipoa"
|| wan_proto == "mer" || wan_proto == "static" )
doTypeChange2(0);
else if (wan_proto == "pppoe")
doTypeChange2(1);
else
doTypeChange2(2);
// loadSettings(index);
// loadcheck();
}
function doTypeChange2(newIndex)
{
var tmpstr;
var cf = document.forms[0];
var index = cf.adslChoice.selectedIndex;
if (newIndex == 0)
{
tmpstr = "ether_m.cgi?nowchoice=" + index + "&nowproto=0";
location.href = tmpstr;
}
else if (newIndex == 1)
{
tmpstr = "pppoe_m.cgi?nowchoice=" + index+ "&nowproto=1";
location.href = tmpstr;
}
else if (newIndex == 2)
{
tmpstr = "pppoa_m.cgi?nowchoice=" + index+ "&nowproto=1";
location.href = tmpstr;
}
}
function doTypeChange3(newIndex)
{
var tmpstr;
var cf = document.forms[0];
var index = cf.adslChoice.selectedIndex;
var mux = cf.dsl_multiplex.value;
var vpi = cf.dsl_vpi.value;
var vci = cf.dsl_vci.value;
var msg = "";
if( isNumeric(cf.dsl_vpi, 255) )
msg = "VPI contains an invalid number"
if( isNumeric(cf.dsl_vci, 65536) )
msg = "VC contains an invalid number"
if (vpi < 0 || vpi > 255)
msg = "VPI is out of range [0~255]"
if (vci < 32 || vci > 65535)
msg = "VC is out of range [32~65535]"
if (msg.length > 1)
{
alert(msg);
return false;
}
if (newIndex == 0)
{
tmpstr="ether_m.cgi?nowchoice="+index+"&havetmpvar=1&gui_mode=1&tmpmux="+mux+"&tmpvpi="+vpi+"&tmpvci="+vci;
location.href = tmpstr;
}
else if (newIndex == 1)
{
tmpstr="pppoe_m.cgi?nowchoice="+index+"&havetmpvar=1&gui_mode=1&tmpmux="+mux+"&tmpvpi="+vpi+"&tmpvci="+vci;
location.href = tmpstr;
}
}
function setServer()
{
var cf = document.forms[0];
var stype = cf.login_type.selectedIndex;
var tmpstr;
var index = cf.adslChoice.selectedIndex;
var mux = cf.dsl_multiplex.value;
var vpi = cf.dsl_vpi.value;
var vci = cf.dsl_vci.value;
var msg = "";
if( isNumeric(cf.dsl_vpi, 255) )
msg = "VPI contains an invalid number"
if( isNumeric(cf.dsl_vci, 65536) )
msg = "VC contains an invalid number"
if (vpi < 0 || vpi > 255)
msg = "VPI is out of range [0~255]"
if (vci < 32 || vci > 65535)
msg = "VC is out of range [32~65535]"
if (msg.length > 1)
{
alert(msg);
return false;
}
if(stype==0) //pppoe
{
tmpstr="pppoe_m.cgi?nowchoice="+index+"&havetmpvar=1&gui_mode=1&tmpmux="+mux+"&tmpvpi="+vpi+"&tmpvci="+vci;
location.href = tmpstr;
}
else if(stype==1) //pppoa
{
tmpstr="pppoa_m.cgi?nowchoice="+index+"&havetmpvar=1&gui_mode=1&tmpmux="+mux+"&tmpvpi="+vpi+"&tmpvci="+vci;
location.href = tmpstr;
}
}
function loadcheck()
{
var cf = document.forms[0];
if (isIE())
{
cf.pppoe_username.size="24";
cf.pppoe_passwd.size="24";
}
loadhelp('BAS_mpppoe');
setIP();
setDNS();
}
function setIP()
{
var cf = document.forms[0];
var dflag = cf.WANAssign[0].checked;
setDisabled(dflag,cf.WPethr1,cf.WPethr2,cf.WPethr3,cf.WPethr4);
if (cf.WANAssign[1].checked)
{
cf.DNSAssign[1].checked = true;
setDNS();
}
DisableFixedIP = dflag;
}
function setDNS()
{
var cf = document.forms[0];
var dflag = cf.DNSAssign[0].checked;
if (cf.WANAssign[1].checked && cf.DNSAssign[0].checked)
{
cf.DNSAssign[1].checked=true;
dflag = false;
}
setDisabled(dflag,cf.DAddr1,cf.DAddr2,cf.DAddr3,cf.DAddr4,cf.PDAddr1,cf.PDAddr2,cf.PDAddr3,cf.PDAddr4);
DisableFixedDNS = dflag;
}
function checkData()
{
var cf = document.forms[0];
var msg = "";
var vpi = cf.dsl_vpi.value;
var vci = cf.dsl_vci.value;
if( isNumeric(cf.dsl_vpi, 255) )
msg = "VPI contains an invalid number"
if( isNumeric(cf.dsl_vci, 65536) )
msg = "VC contains an invalid number"
if (vpi < 0 || vpi > 255)
msg = "VPI is out of range [0~255]"
if (vci < 32 || vci > 65535)
msg = "VC is out of range [32~65535]"
msg+= checkBlank(cf.pppoe_username, "User name");
if(cf.pppoe_idletime.value.length<=0)
msg+= "Please enter idle time.\n";
else if(!_isNumeric(cf.pppoe_idletime.value))
msg+= "Invalid idle time,please enter proper numeral.\n";
if(cf.WANAssign[1].checked)
{
if(checkIP(cf.WPethr1,cf.WPethr2,cf.WPethr3,cf.WPethr4,254)||(parseInt(cf.WPethr4.value)==0))
msg+= "Invalid static IP address.\n";
cf.pppoe_localip.value = cf.WPethr1.value+'.'+cf.WPethr2.value+'.'+cf.WPethr3.value+'.'+cf.WPethr4.value;
}
else
cf.pppoe_localip.value = "0.0.0.0";
if(cf.DNSAssign[1].checked)
{
if(checkIP(cf.DAddr1,cf.DAddr2,cf.DAddr3,cf.DAddr4,254)||(parseInt(cf.DAddr4.value)==0))
msg+= "Invalid Primary DNS Address, please enter again.\n";
if(cf.PDAddr1.value.length>0)
if(checkIP(cf.PDAddr1,cf.PDAddr2,cf.PDAddr3,cf.PDAddr4,254)||(parseInt(cf.PDAddr4.value)==0))
msg+= "Invalid Secondary DNS Address, please enter again.\n";
}
if (duplicatepvcChk(vpi,vci))
msg += "duplicate PVC found!\n";
if (msg.length > 1)
{
alert(msg);
return false;
}
cf.wan_dns1_pri.value = cf.DAddr1.value+'.'+cf.DAddr2.value+'.'+cf.DAddr3.value+'.'+cf.DAddr4.value;
cf.wan_dns1_sec.value = cf.PDAddr1.value+'.'+cf.PDAddr2.value+'.'+cf.PDAddr3.value+'.'+cf.PDAddr4.value;
cf.nowchoice.value = -1;
return true;
}
function duplicatepvcChk(vpi, vci)
{
var cf = document.forms[0];
var index = cf.adslChoice.selectedIndex;
if (( index != 0) && (vpi == cf.atm0_vpi.value) && (vci == cf.atm0_vci.value) && (cf.wan0_dial.value == "1"))
return true;
if ((index != 1) && (vpi == cf.atm1_vpi.value) && (vci == cf.atm1_vci.value) && (cf.wan1_dial.value == "1"))
return true;
if ((index != 2) && (vpi == cf.atm2_vpi.value) && (vci == cf.atm2_vci.value) && (cf.wan2_dial.value == "1"))
return true;
if ((index != 3) && (vpi == cf.atm3_vpi.value) && (vci == cf.atm3_vci.value) && (cf.wan3_dial.value == "1"))
return true;
if ((index != 4) && (vpi == cf.atm4_vpi.value) && (vci == cf.atm4_vci.value) && (cf.wan4_dial.value == "1"))
return true;
if ((index != 5) && (vpi == cf.atm5_vpi.value) && (vci == cf.atm5_vci.value) && (cf.wan5_dial.value == "1"))
return true;
if ((index != 6) && (vpi == cf.atm6_vpi.value) && (vci == cf.atm6_vci.value) && (cf.wan6_dial.value == "1"))
return true;
if ((index != 7) && (vpi == cf.atm7_vpi.value) && (vci == cf.atm7_vci.value) && (cf.wan7_dial.value == "1"))
return true;
return false;
}
function resetPvc()
{
window.location.href="BAS_mpppoe.htm";
}
function loadSettings(index)
{
var cf = document.forms[0];
var pppoe_localip;
var wan_dns1_pri;
var wan_dns1_sec;
var tmp;
var wan_proto;
var dod;
if (index == 100)
index = eval(cf.nowchoice.value);
loadvpivci(index);
wan_proto = all_wan_proto[index];
if (all_pppoe_localip[index].length!=0)
{
pppoe_localip=all_pppoe_localip[index].split(".");
cf.WPethr1.value = pppoe_localip[0];
cf.WPethr2.value = pppoe_localip[1];
cf.WPethr3.value = pppoe_localip[2];
cf.WPethr4.value = pppoe_localip[3];
}
var wan_dns_sel = all_wan_dns_sel[index];
if ( all_wan_dns1_pri[index].length!=0 )
{
wan_dns1_pri = all_wan_dns1_pri[index].split(".");
cf.DAddr1.value = wan_dns1_pri[0];
cf.DAddr2.value = wan_dns1_pri[1];
cf.DAddr3.value = wan_dns1_pri[2];
cf.DAddr4.value = wan_dns1_pri[3];
}
if ( all_wan_dns1_sec[index].length!=0 )
{
wan_dns1_sec = all_wan_dns1_sec[index].split(".");
cf.PDAddr1.value = wan_dns1_sec[0];
cf.PDAddr2.value = wan_dns1_sec[1];
cf.PDAddr3.value = wan_dns1_sec[2];
cf.PDAddr4.value = wan_dns1_sec[3];
}
cf.pppoe_idletime.value = all_pppoe_idletime[index];
if (all_ppp_dod[index] == 2)
cf.pppoe_idletime.disabled = true;
else
cf.pppoe_idletime.disabled = false;
//if (all_pppoe_localip[index]=="0.0.0.0")
// cf.WANAssign[0].checked = true;
//else
// cf.WANAssign[1].checked = true;
if (all_is_static_ip[index] == 1)//static ip
cf.WANAssign[1].checked = true;
else
cf.WANAssign[0].checked = true;
cf.DNSAssign[wan_dns_sel].checked = true;
if (all_wan_isbridge[index] == 1)
cf.nat_enable[2].checked = true;
else if (all_wan_nat[index] == 1)
cf.nat_enable[0].checked = true;
else
cf.nat_enable[1].checked = true;
cf.pppoe_username.value = all_pppoe_username[index];
cf.pppoe_passwd.value = all_pppoe_passwd[index];
cf.pppoe_servicename.value = all_pppoe_servicename[index];
//water
setIP();
setDNS();
}
function loadvpivci(index)
{
var cf = document.forms[0];
var multiplex;
var vpi;
var vci;
switch(index)
{
case 0:
vpi=cf.atm0_vpi.value;
vci=cf.atm0_vci.value;
multiplex=cf.atm0_encap.value;
break;
case 1:
vpi=cf.atm1_vpi.value;
vci=cf.atm1_vci.value;
multiplex=cf.atm1_encap.value;
break;
case 2:
vpi=cf.atm2_vpi.value;
vci=cf.atm2_vci.value;
multiplex=cf.atm2_encap.value;
break;
case 3:
vpi=cf.atm3_vpi.value;
vci=cf.atm3_vci.value;
multiplex=cf.atm3_encap.value;
break;
case 4:
vpi=cf.atm4_vpi.value;
vci=cf.atm4_vci.value;
multiplex=cf.atm4_encap.value;
break;
case 5:
vpi=cf.atm5_vpi.value;
vci=cf.atm5_vci.value;
multiplex=cf.atm5_encap.value;
break;
case 6:
vpi=cf.atm6_vpi.value;
vci=cf.atm6_vci.value;
multiplex=cf.atm6_encap.value;
break;
case 7:
vpi=cf.atm7_vpi.value;
vci=cf.atm7_vci.value;
multiplex=cf.atm7_encap.value;
break;
}
var tmpvarhave = "";
var tmpmux = "";
var tmpvpi = "";
var tmpvci = "";
if (tmpvarhave == 1)
{
if (multiplex != tmpmux)
cf.cfgChanged.value='1';
if (vpi != tmpvpi)
cf.cfgChanged.value='1';
if (vci != tmpvci)
cf.cfgChanged.value='1';
multiplex = tmpmux;
vpi = tmpvpi;
vci = tmpvci;
}
if (multiplex == "LLC")
cf.dsl_multiplex.selectedIndex = 0;
else
cf.dsl_multiplex.selectedIndex = 1;
cf.dsl_vpi.value=vpi;
cf.dsl_vci.value=vci;
}
function setCfgChanged()
{
var cf = document.forms[0];
cf.cfgChanged.value='1';
}
function checkTest()
{
var cf = document.forms[0];
var ret = checkData();
var winoptions = "width=640,height=480,menubar=yes,toolbar=yes,status=yes,location=yes,resizable=yes";
//var winoptions = "width=400,height=360,status=yes,resizable=yes";
if ( ret == true)
{
if (cf.cfgChanged.value=='0')
{
//openDataSubWin('wtest.htm',winoptions);
//cf.nowchoice.value = 100;
//checkData();
//document.formname.submit();
var tmpstr = "pppoe_m.cgi?nowchoice=100" + "&nowproto=0";
location.href = tmpstr;
//return true;
}
else
{
cf.testpressed.value = '1';
cf.nowchoice.value = -1;
document.formname.submit();
}
}
}
</script>
</head>
<body bgcolor="#ffffff" onload="loadMultiWanInfo();loadSettings(100);loadcheck();goTestApply();">
<form name="formname" method="POST" action="pppoe_m.cgi">
<table border="0" cellpadding="0" cellspacing="3" width="99%">
<tr>
<td colspan="2"><h1>Basic Settings</h1></td>
</tr>
<tr>
<td colspan="2">
<select name="adslChoice" onChange="ChangeAdslChoice();" size="1">
<option value=0>WAN1</option>
</select>
</td>
</tr>
<!-- RULE
<tr>
<td colspan="2" background="liteblue.gif" height="12"> </td>
</tr>
<tr>
<td nowrap width="50%">Multiplexing Method</TD>
<td width="50%" align="right">
<SELECT name="dsl_multiplex" size="1">
<option value="LLC">LLC-BASED</option>
<option value="VC">VC-BASED</option>
</SELECT></TD>
</TR>
<TR>
<td nowrap width="50%">VPI</td>
<td nowrap width="50%" align="right"><input type="text" class="num" name="dsl_vpi" size="3" maxlength="3"></td>
</tr>
<TR>
<td nowrap width="50%">VCI</td>
<td nowrap width="50%" align="right"><input type="text" class="num" name="dsl_vci" size="5" maxlength="5"></td>
</tr>
-->
<INPUT name=dsl_multiplex type=hidden value= "">
<INPUT name=dsl_vpi type=hidden value= "">
<INPUT name=dsl_vci type=hidden value= "">
<tr> <!-- RULE -->
<td colspan="2" background="liteblue.gif" height="12"> </td>
</tr>
<tr>
<td colspan="2">
<p><a href="javascript:loadhelp('BAS_mpppoe','question')" tabindex="-1"><b>Does Your Internet Connection Require A Login?</b></a></p></td>
</tr>
<tr>
<td colspan="2"><input type="radio" checked name="loginreq" value="pppoe" onClick="doTypeChange3(1);">
<a href="javascript:loadhelp('BAS_mpppoe','question')" tabindex="-1">Yes</a></td>
</tr>
<tr>
<td colspan="2"><input type="radio" name="loginreq" value="dhcp" onClick="doTypeChange3(0);">
<a href="javascript:loadhelp('BAS_mpppoe','question')" tabindex="-1">No</a></td>
</tr>
<tr>
<td width="50%"><a href="javascript:loadhelp('BAS_mpppoe','isp')" tabindex="-1"><b>Encapsulation</b></a></td>
<td width="50%" align="right"><select name="login_type" onChange="setServer()"><option>PPPoE (PPP over Ethernet)</option><!-- temp marked by Silver <option>PPPoA (PPP over ATM)</option>--></select></td>
</tr>
<tr> <!-- RULE -->
<td colspan="2" background="liteblue.gif" height="12"> </td>
<tr>
<td><a href="javascript:loadhelp('BAS_mpppoe','login')" tabindex="-1"><b>Login</b></a></td>
<td align="right"><input type="text" name="pppoe_username" size="15" maxlength="60" value="" onChange="setCfgChanged()"></td>
</tr>
<tr>
<td><a href="javascript:loadhelp('BAS_mpppoe','password')" tabindex="-1"><b>Password</b></a></td>
<td align="right"><input type="password" name="pppoe_passwd" size="15" maxlength="50" value="" onChange="setCfgChanged()"></td>
</tr>
<tr>
<td nowrap><a href="javascript:loadhelp('BAS_mpppoe','serv_name')" tabindex="-1"><b>Service Name</b></a> (If Required) </td>
<td align="right"><input type="text" name="pppoe_servicename" maxlength="63" size="15" value="" onChange="setCfgChanged()"></td>
</tr>
<tr>
<td nowrap><a href="javascript:loadhelp('BAS_mpppoe','idletime')" tabindex="-1"><b>Idle Timeout</b></a> (In Minutes)</td>
<td align="right"><input type="text" class="num" name="pppoe_idletime" size="3" maxlength="3" onChange="setCfgChanged()"></td>
</tr>
<tr> <!-- RULE -->
<td colspan="2" background="liteblue.gif" height="12"> </td>
</tr>
<tr>
<td colspan="2"><a href="javascript:loadhelp('BAS_mpppoe','InternetIP')" tabindex="-1"><b>Internet IP Address</b></a></td>
</tr>
<tr>
<td colspan="2"><input type="radio" name="WANAssign" value="Dynamic" onClick="setIP()" onChange="setCfgChanged()">Get Dynamically From ISP</td>
</tr>
<tr>
<td nowrap><input type="radio" name="WANAssign" value="Fixed" onClick="setIP()" onChange="setCfgChanged()">Use Static IP Address</td>
<td align="right" class="num">
<input type="text" name="WPethr1" class="num" size="4" maxlength="3" onFocus="if(DisableFixedIP) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="WPethr2" class="num" size="4" maxlength="3" onFocus="if(DisableFixedIP) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="WPethr3" class="num" size="4" maxlength="3" onFocus="if(DisableFixedIP) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="WPethr4" class="num" size="4" maxlength="3" onFocus="if(DisableFixedIP) this.blur()" onChange="setCfgChanged()"></td>
</tr>
<tr> <!-- RULE -->
<td colspan="2" background="liteblue.gif" height="12"> </td>
</tr>
<tr>
<td colspan="2"><a href="javascript:loadhelp('BAS_mpppoe','DNSaddress')" tabindex="-1"><b>Domain Name Server (DNS) Address </b></a></td>
</tr>
<tr>
<td colspan="2"><input type="radio" name="DNSAssign" value="0" onClick="setDNS()" onChange="setCfgChanged()"> Get Automatically From ISP</td>
</tr>
<tr>
<td colspan="2"><input type="radio" name="DNSAssign" value="1" onClick="setDNS()" onChange="setCfgChanged()"> Use These DNS Servers</td>
</tr>
<tr>
<td><img src="spacer.gif" width="20" height="12" border="0">Primary DNS</td>
<td align="right" class="num">
<input type="text" name="DAddr1" class="num" size="4" maxlength="3" onFocus="if(DisableFixedDNS) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="DAddr2" class="num" size="4" maxlength="3" onFocus="if(DisableFixedDNS) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="DAddr3" class="num" size="4" maxlength="3" onFocus="if(DisableFixedDNS) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="DAddr4" class="num" size="4" maxlength="3" onFocus="if(DisableFixedDNS) this.blur()" onChange="setCfgChanged()"></td>
</tr>
<tr>
<td><img src="spacer.gif" width="20" height="12" border="0"><a href="javascript:loadhelp('BAS_mpppoe','DNSaddress')" tabindex="-1">Secondary DNS</a></td>
<td align="right" class="num">
<input type="text" name="PDAddr1" class="num" size="4" maxlength="3" onFocus="if(DisableFixedDNS) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="PDAddr2" class="num" size="4" maxlength="3" onFocus="if(DisableFixedDNS) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="PDAddr3" class="num" size="4" maxlength="3" onFocus="if(DisableFixedDNS) this.blur()" onChange="setCfgChanged()">.
<input type="text" name="PDAddr4" class="num" size="4" maxlength="3" onFocus="if(DisableFixedDNS) this.blur()" onChange="setCfgChanged()"></td>
</tr>
<tr> <!-- RULE -->
<td colspan="2" background="liteblue.gif" height="12"> </td>
</tr>
<tr>
<td colspan="2"><a href="javascript:loadhelp('BAS_mpppoe','nat')" tabindex="-1"><b>NAT (Network Address Translation) </b></a></td>
</tr>
<tr>
<td> </td>
<td align="right">
<input type="radio" name="nat_enable" value="1" onChange="setCfgChanged()"> Enable
<input type="radio" name="nat_enable" value="0" onChange="setCfgChanged()"> Disable
<input type="radio" name="nat_enable" value="2" onChange="setCfgChanged()"> Bridge
</td>
</tr>
<tr> <!-- RULE -->
<td colspan="2" background="liteblue.gif" height="12"> </td>
</tr>
<tr>
<td colspan="2" align="center"><div ID="pppoebuttons" onmouseover="loadhelp('BAS_mpppoe','buttons')">
<input type="SUBMIT" name="apply" value="Apply" onClick="return checkData()">
<input type="BUTTON" name="Cancel" value="Cancel" onClick="resetPvc();">
<input type="BUTTON" name="Test" value="Test" onClick="checkTest();">
</div></td></tr>
</table>
<INPUT name=gui_mode type=hidden value= "1">
<INPUT name=nowchoice type=hidden value= "0">
<INPUT name=pppoe_localip type=hidden value= "">
<INPUT name=wan_dns_sel type=hidden value= "">
<INPUT name=wan_dns1_pri type=hidden value= "">
<INPUT name=wan_dns1_sec type=hidden value= "">
<INPUT name=atm0_vpi type=hidden value= "8">
<INPUT name=atm0_vci type=hidden value= "48">
<INPUT name=atm0_multiplex type=hidden value= "llcencaps">
<INPUT name=atm0_encap type=hidden value= "LLC">
<INPUT name=atm1_vpi type=hidden value= "0">
<INPUT name=atm1_vci type=hidden value= "32">
<INPUT name=atm1_multiplex type=hidden value= "llcencaps">
<INPUT name=atm1_encap type=hidden value= "LLC">
<INPUT name=atm2_vpi type=hidden value= "0">
<INPUT name=atm2_vci type=hidden value= "33">
<INPUT name=atm2_multiplex type=hidden value= "llcencaps">
<INPUT name=atm2_encap type=hidden value= "LLC">
<INPUT name=atm3_vpi type=hidden value= "0">
<INPUT name=atm3_vci type=hidden value= "34">
<INPUT name=atm3_multiplex type=hidden value= "llcencaps">
<INPUT name=atm3_encap type=hidden value= "LLC">
<INPUT name=atm4_vpi type=hidden value= "0">
<INPUT name=atm4_vci type=hidden value= "35">
<INPUT name=atm4_multiplex type=hidden value= "llcencaps">
<INPUT name=atm4_encap type=hidden value= "LLC">
<INPUT name=atm5_vpi type=hidden value= "0">
<INPUT name=atm5_vci type=hidden value= "36">
<INPUT name=atm5_multiplex type=hidden value= "llcencaps">
<INPUT name=atm5_encap type=hidden value= "LLC">
<INPUT name=atm6_vpi type=hidden value= "0">
<INPUT name=atm6_vci type=hidden value= "37">
<INPUT name=atm6_multiplex type=hidden value= "llcencaps">
<INPUT name=atm6_encap type=hidden value= "LLC">
<INPUT name=atm7_vpi type=hidden value= "0">
<INPUT name=atm7_vci type=hidden value= "38">
<INPUT name=atm7_multiplex type=hidden value= "llcencaps">
<INPUT name=atm7_encap type=hidden value= "LLC">
<input type="hidden" name="cfgChanged" value="0">
<input type="hidden" name="testpressed" value="0">
<input type="hidden" name="runtest" value="no">
<INPUT name=wan0_dial type=hidden value= "1">
<INPUT name=wan1_dial type=hidden value= "0">
<INPUT name=wan2_dial type=hidden value= "0">
<INPUT name=wan3_dial type=hidden value= "0">
<INPUT name=wan4_dial type=hidden value= "0">
<INPUT name=wan5_dial type=hidden value= "0">
<INPUT name=wan6_dial type=hidden value= "0">
<INPUT name=wan7_dial type=hidden value= "0">
</form>
<p></p>
</body>
