Last year, D-Link flubbed a router bug-fix, so it's back with total pwnage

guest · Oct 17, 2018

Last year, D-Link flubbed a router bug-fix, so it's back with total pwnage
October 17, 2018
https://www.theregister.co.uk/2018/10/17/dlink_security_flaws/

Eight D-Link router variants are vulnerable to complete pwnage via a combination of security screwups, and only two are going to get patched.

Błażej Adamczyk of the Silesian University of Technology in Poland posted this month to Full Disclosure that he discovered the bugs in May of this year and notified D-Link. Despite insisting patches would be released four months ago from now, D-Link hasn't addressed the issue, so Adamczyk has gone public with the security holes.

First, there's CVE-2018-10822, a directory traversal bug in the web-based configuration interface, which lets an attacker retrieve arbitrary files. Adamczyk wrote that this arose from a bug in a fix for an earlier vulnerability, CVE-2017-6190 [...]

Finally, CVE-2018-10823 allows an attacker able to log into the router to inject shell commands into the routers' HTTP web server: “An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.”
Click to expand...

Log in or Sign up

Last year, D-Link flubbed a router bug-fix, so it's back with total pwnage

guest Guest

Log in or Sign up

Last year, D-Link flubbed a router bug-fix, so it's back with total pwnage

guest Guest

Useful Searches