Unpatched D-Link Router Vulnerabilities Disclosed

itman · Sep 8, 2017

A researcher has disclosed the details of several unpatched vulnerabilities affecting D-Link DIR-850L routers and mydlink cloud services.

Researcher Pierre Kim has decided to make his findings public without giving D-Link time to release fixes due to the way the company handled patching and coordination for previously reported vulnerabilities.

“Their previous lack of consideration about security made me publish this research without coordinated disclosure,” Kim explained.

The expert discovered in mid-June that both revisions A and B of the DIR-850L firmware lack proper protection. The former allows an attacker to easily forge a firmware image, while the latter is protected with a hardcoded password.

He also found several cross-site scripting (XSS) vulnerabilities that can be exploited to steal authentication cookies from logged-in users. Hackers could also exploit various flaws to change a router’s DNS settings and forward the victim’s traffic to a malicious server, cause some services to enter a denial-of-service (DoS) condition, and execute arbitrary commands as root via the DHCP client.
Click to expand...

http://www.securityweek.com/unpatched-d-link-router-vulnerabilities-disclosed

itman · Sep 13, 2017

Second Researcher Drops Router Exploit Code After D-Link Mishandles Bug Reports

Embedi, a hardware security firm, has published details about two vulnerabilities that have yet to be patched in the firmware of D-Link routers. This marks the second incident of this sort in the last five days.

Last Friday, South Korean security researcher Pierre Kim also published public details about ten unpatched vulnerabilities in D-Link routers.

The researcher published the details without giving D-Link the chance to fix the flaws. Kim says he took this step after reporting similar issues in D-Link products in February that the company ignored.

Embedi: Interaction with the developer has brought no results

Embedi says it contacted D-Link about the vulnerabilities it found, but its "interaction with the developer [...] has brought no results," albeit D-Link fixed one of the three vulnerabilities researchers reported.

After three months during which D-Link has failed to fix the other two flaws, the security firm has now decided to release details about the three vulnerabilities it reported, along with proof-of-concept exploit code for each, including the two flaws that D-Link has yet to fix.

According to Embedi, the reported flaws affect DIR890L, DIR885L, and DIR895L router models, but they suspect that other DIR8xx D-Link routers may be affected as well.
Click to expand...

https://www.bleepingcomputer.com/ne...oit-code-after-d-link-mishandles-bug-reports/

Log in or Sign up

Unpatched D-Link Router Vulnerabilities Disclosed

itman Registered Member

itman Registered Member

Log in or Sign up

Unpatched D-Link Router Vulnerabilities Disclosed

itman Registered Member

itman Registered Member

Useful Searches