D-Link DIR-100 Multiple Security Vulnerabilities

Bugtraq ID:	65290
Class:	Unknown
CVE:	CVE-2013-7051 CVE-2013-7052 CVE-2013-7053 CVE-2013-7054 CVE-2013-7055
Remote:	Yes
Local:	No
Published:	Dec 03 2013 12:00AM
Updated:	Dec 03 2013 12:00AM
Credit:	Felix Richter
Vulnerable:	D-Link DIR-100 4.03B07
Not Vulnerable:	D-Link DIR-100 4.03B13

D-Link DIR-100 Multiple Security Vulnerabilities

D-Link DIR-100 is prone to the following security vulnerabilities:

1. An authentication-bypass vulnerability
2. Multiple information-disclosure vulnerabilities
3. A cross-site request-forgery vulnerability
4. A cross-site scripting vulnerability

An attacker can exploit these issues to execute HTML and arbitrary script code in the browser of an unsuspecting user in the context of the affected device, steal cookie-based authentication credentials, bypass-authentication mechanism, gain access to potentially sensitive information. Other attacks are also possible.

D-Link DIR-100 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

D-Link DIR-100 Multiple Security Vulnerabilities

References:

• D-Link Homepage (D-Link)
  
• Latest updates for router models DIR-100 (A1), DI-524UP, DSR-250N/500N/1000N an (D-Link)
  
• Router D-Link DIR-100 Multiple Vulnerabilities (Fulldisclosure)