Multiple Vendors 'alpha_auth_check()' Function Remote Authentication Bypass Vulnerability

Bugtraq ID:	62990
Class:	Access Validation Error
CVE:	CVE-2013-6026
Remote:	Yes
Local:	No
Published:	Oct 12 2013 12:00AM
Updated:	Dec 10 2013 12:56AM
Credit:	Craig Heffner and /dev/ttyS0
Vulnerable:
Not Vulnerable:

Multiple Vendors 'alpha_auth_check()' Function Remote Authentication Bypass Vulnerability

Multiple vendors are prone to a remote authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and gain access to the affected device. This may aid in further attacks.

The following are vulnerable:

D-Link DIR-120
D-Link DI-624S
D-Link DI-524UP
D-Link DI-604S
D-Link DI-604UP
D-Link DI-604
D-Link DIR-100
D-Link TM-G5240
PLANEX COMMUNICATIONS BRL-04UR
PLANEX COMMUNICATIONS BRL-04R
PLANEX COMMUNICATIONS BRL-04CW

Multiple Vendors 'alpha_auth_check()' Function Remote Authentication Bypass Vulnerability

An attacker can exploit this issue using a web browser.

The following exploits are available:

• /data/vulnerabilities/exploits/62990.rb
• /data/vulnerabilities/exploits/62990.py
• /data/vulnerabilities/exploits/62990.php.txt

Multiple Vendors 'alpha_auth_check()' Function Remote Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Vendors 'alpha_auth_check()' Function Remote Authentication Bypass Vulnerability

References:

• D-Link Homepage (D-Link)