So basically, a back door.:(
I will dig a bit

It's the user name and the password you have set in order to authenticate in the router web interface. A simple login attempt ends up with an error about not being able to create a TTY. Consequently, you must know in advance what command to launch on the router instead of a shell.

alx_max wrote

It's the user name and the password you have set in order to authenticate in the router web interface. A simple login attempt ends up with an error about not being able to create a TTY. Consequently, you must know in advance what command to launch on the router instead of a shell.

I cannot confirm this. Telnet will work with the credentials from the WEBGUI, but SSH won't authenticate me.
Firmwareversion:0.8.0 0.5 v0053.0 Build 160122 Rel.41839n Hardwareversion:Archer VR200 v1 00000000

It's not a good feeling having a running ssh daemon, that you can't access...

Actually the port 22 is opened only for the Tether App from TP-Link which will restrict any other SSH connections.
It's designed to avoid any security problems.
The default login username and password are the ones you set for the web UI.

I'm not going to argue with you on what I regard to be security by obscurity...
BTW1: I find it embarrassing not be able to log in to a router with ssh with just a normal busybox available on it, nowadays. Since latest firmware was updated, many security breaches, e.g. in the linux kernel (2 priviledge escalation exploits, the latest for mod_hdlc, that is used by mod_ppp and 1 DoS) have been discovered. These issues have not yet been addressed.
I'd appreciate to receive updated firmware.

Back to the main topic: what you explain, does not seem to be right - at least not with a secure password containing special characters:
If the user name and password where the same for the app's ssh access, the non-app-ssh client would log in first and ssh would terminate the session right after.
But in my case, the user 'root' or rather 'admin' with the password from the GUI won't be accepted - the password will be asked for over and over until ssh terminates after on the third try. As mentioned before, the telnet server on the VR200 would accept the very same user/pass combination I am trying to use for SSH.

If there where mere USB-VDSL2-Vectoring modems models available on the market, I'd rather prefer these over any router model with limited access or ageing firmware. Unfortunately, this isn't possible right now.

I'd now like to debug the MTU-issue, that's causing packet loss or at least packet fragmentation. The VR200's CLI obviously isn't usuable for even debugging this.
What other solutions exist to reliably set the MTU to 1500 + 6 + 2 + 4 = 1512 bytes on the ptm? I need to get an effective MTU of 1500, that is, PPPoE with tagged VLAN.

Any helpful suggestions are highly welcome!

Best regards!
Epek

I don't think allowing telnet and restricting SSH makes ANY sens in terms for security, in terms of insecurity, maybe.

Any news on that?

In the meanwhile I figured out how to obtain a root shell on my VR200 instead of the TP-LINK Cli.
The results are disappointing. Setting an MTU greater than 1500 on any of the interfaces will fail with an RTNETLINK error. This indicates, that drivers and kernel (2.6.x) are way too old to support this feature.

My hope now is, that an open firmware may circumvent these problems.
Nevertheless a bad feeling remains, since the root shell exploit is hardly difficult to apply. Unchecked variable values from the GUI... subshell. Requires a local user. Nuff said.

epek wrote

In the meanwhile I figured out how to obtain a root shell on my VR200 instead of the TP-LINK Cli.

How you did it?
I'm trying to do the same with an Archer VR400 because the CLI is really limited (cannot configure port forwarding throught CLI).