Is the hostname "_gateway" (on systemd linuxes) a security issue?

[Marcus Linsner]

Since systemd exposes the hostname "_gateway" (ie. `ping _gateway`) on systemd OSes, does this pose any security risk if any website decides to use that hostname to access your router?

On appVMs this apparently can't be an issue, because _gateway points to a 10. IP class, in fact, it point to sys-firewall's IP (assuming sys-firewall is the net VM set for that appVM in its settings).

On a vanilla Linux though, it seems that websites could access the router by using the _gateway hostname. Does anyone know if this can be done? It'd be kinda lame if so... and I can only imagine the attacks that could be performed.

[Ángel]

How would that be different than a website accessing the router using a
private address like 192.168.0.1 ? It requires a bit of guessing, but
not too much, as a few addresses are used by 90% of routers.

The onus is on the routers not to have bugs on their web interface that
could be exploited by a malicious web page (they should both require a
password —which may not be too secret— and a CSRF).
Sadly, experience has shown that this is not always the case.

Browsers of course could add some extra safeguards (eg. Opera did), you
may be interested in watching this 12 years old mozilla RFE:
https://bugzilla.mozilla.org/show_bug.cgi?id=354493

Regards