Yet another serious router vulnerability has been disclosed: https://www.exploit-db.com/exploits/40889/

This is a command execution vulnerability through the web interface. I'm not too concerned about internal users being able to exploit it; I only allow trusted people on my network. However, a major concern is that external web sites could exploit it as a CSRF attack.

How can I configure Chrome to prevent external web sites referencing or redirecting to my router? Ideally I'd like to still be able to manually browse to the router admin page, although I guess I can live without that.

For FireFox, the NoScript plugin can do this using ABE - Application Boundaries Enforcer.

As a workaround I have patched the router and put it on a non-predictable IP address. However, that's only a partial solution as further issues are likely to appear in future, and there are various ways for web pages to access private IP addresses (e.g. WebRTC, Java).

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked:

From an official 2008 PDF: PCI Data Storage Do’s and Don’ts:


  Never store the personal identification number (PIN) or PIN Block. Be
  sure to mask PAN whenever it is displayed. The first six and last four
  digits are the maximum number of digits that may be displayed.


PAN is Primary Account Number

So as far as compliance goes, the data terminal used to print the receipt is compliant.
