Full Disclosure mailing list archives
Vulnerabilities in D-Link DIR-300
From: "MustLive" <mustlive () websecurity com ua>
Date: Mon, 31 Oct 2016 20:55:15 +0200
Hello list! There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DIR-300. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DIR-300NRUB5, Firmware 1.2.94. All previous versions also must be vulnerable. ---------- Details: ---------- Abuse of Functionality (WASC-42): Admin's login is persistent: admin. Which simplify BF and CSRF attacks. Brute Force (WASC-11): http://site No protection from BF attacks. If there is no Path Traversal vulnerability in this device to get admin's password, then it's possible to pick it up. Even I found DIR-300 with firmware version from 2009, where there was a captcha (that can be turned on/off in the settings), but there was no captcha in new firmware. Cross-Site Request Forgery (WASC-09): Change admin's password: http://site/index.cgi?v2=y&rq=y&res_config_action=3&res_config_id=69&res_struct_size=1&res_buf=password| ------------ Timeline: ------------ 2015.04.24 - announced at my site about vulnerabilities in DIR-300.2015-2016 - informed developers about multiple vulnerabilities in this and other D-Link devices.
2016.08.27 - disclosed at my site (http://websecurity.com.ua/7722/). Best wishes & regards, MustLive Administrator of Websecurity web sitehttp://websecurity.com.ua
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Vulnerabilities in D-Link DIR-300 MustLive (Nov 01)