Multiple D-Link Router Authentication Bypass Vulnerabilities

vendor:

DIR-300, DIR-320, DIR-615 revD

by:

Craig Heffner

7,5

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: DIR-300, DIR-320, DIR-615 revD

Affected Version From: All

Affected Version To: All

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: DIR-300, DIR-320, DIR-615 revD

2011

Multiple D-Link Router Authentication Bypass Vulnerabilities

Multiple D-Link routers that use a PHP based Web interface suffer from the same authentication bypass vulnerability which allows unprivileged users to view and modify administrative router settings. Further, even if remote administration is disabled this vulnerability can be exploited by a remote attacker via a CSRF attack.

Mitigation:

Disable remote administration, use strong passwords, and ensure that all routers are running the latest firmware version.

Source

Exploit-DB raw data:

# Exploit Title: Multiple D-Link Router Authentication Bypass Vulnerabilities
# Date: 12-01-2011
# Author: Craig Heffner, /dev/ttyS0
# Firmware Link: http://www.dlink.co.uk/
# Firmware Version(s): All
# Tested on: DIR-300, DIR-320, DIR-615 revD

Multiple D-Link routers that use a PHP based Web interface suffer from the same authentication bypass
vulnerability which allows unprivileged users to view and modify administrative router settings.
Further, even if remote administration is disabled this vulnerability can be exploited by a remote
attacker via a CSRF attack.

The vulnerability has been confirmed in the following routers:

	DIR-615 revD
	DIR-320
	DIR-300

The following example URL will allow access to the router's main administrative Web page without authentication:

	http://192.168.0.1/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0

For a more detailed description of the vulnerability, see: http://www.devttys0.com/wp-content/uploads/2010/12/dlink_php_vulnerability.pdf.

Note that this vulnerability was independently discovered in the DIR-300 and subsequently reported by Karol Celin on 09-Nov-2010 [1].

[1] http://www.securityfocus.com/archive/1/514687/30/120/threaded