The guys at gnucitizen have posted details of another vulnerability in the BT home hub (and related Thomson routers). This vulnerability allows a remote attacker to reconfigure the router using the UPnP functionality which is turned on by default. UPnP is an authenticationless protocol designed to allow local devices to reconfigure the router – typically to allow insertion of port forwarding rules or similar changes to the firewall. On the Thomson routers (and the home hub) UPnP configuration can be found under “Game and Application Sharing” on the web configuration interface.
If you haven’t already done so, I recommend that you turn off UPnP. There is no good reason to leave it on. If you find that some device on your network needs a particular port forwarding rule to be set, then set it manually. Better still, consider whether you really need that device on your network.