D-Link DIR-600 and DIR-300 Multiple Security Vulnerabilities
BID:57734
Info
D-Link DIR-600 and DIR-300 Multiple Security Vulnerabilities
| Bugtraq ID: | 57734 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 05 2013 12:00AM |
| Updated: | Aug 09 2013 09:06AM |
| Credit: | Michael Messner |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
D-Link DIR-600 and DIR-300 Multiple Security Vulnerabilities
D-Link DIR-600 and DIR-300 are prone to a multiple security vulnerabilities, including:
1. A remote command-execution vulnerability
2. Multiple information-disclosure vulnerabilities
3. A security-bypass vulnerability
4. A password encryption weakness
5. An HTML-injection vulnerability
Exploiting these issues could allow an attacker to bypass authentication, decrypt stored passwords, disclose sensitive information, execute HTML and arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or execute arbitrary commands in the context of the affected device.
D-Link DIR-600 and DIR-300 are prone to a multiple security vulnerabilities, including:
1. A remote command-execution vulnerability
2. Multiple information-disclosure vulnerabilities
3. A security-bypass vulnerability
4. A password encryption weakness
5. An HTML-injection vulnerability
Exploiting these issues could allow an attacker to bypass authentication, decrypt stored passwords, disclose sensitive information, execute HTML and arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or execute arbitrary commands in the context of the affected device.
Exploit / POC
D-Link DIR-600 and DIR-300 Multiple Security Vulnerabilities
Attackers can use readily available tools to exploit the issues.
The following example data and metasploit module are available:
Attackers can use readily available tools to exploit the issues.
The following example data and metasploit module are available:
Solution / Fix
D-Link DIR-600 and DIR-300 Multiple Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are error or if you are aware of any more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are error or if you are aware of any more recent information, please mail us at: [email protected].