D-Link DNR-322L and DNR-326 Multiple Security Vulnerabilities

Bugtraq ID:	68699
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jul 16 2014 12:00AM
Updated:	Jul 16 2014 12:00AM
Credit:	Qualys Security Research Team
Vulnerable:	D-Link DNR-326 Ax 1.30b01 D-Link DNR-322L Ax 1.00b07
Not Vulnerable:	D-Link DNR-326 Ax 2.10b02 D-Link DNR-322L Ax 2.00b07

D-Link DNR-322L and DNR-326 Multiple Security Vulnerabilities

D-Link DNR-322L and DNR-326 are prone to an authentication-bypass vulnerability, multiple information-disclosure vulnerabilities, an arbitrary firmware-upload vulnerability, and a denial-of-service vulnerability.

Exploiting these vulnerabilities may allow an attacker to the authentication mechanism, perform unauthorized actions, upload arbitrary firmware, cause denial-of-service conditions, or disclose sensitive information. This may aid in further attacks.

D-Link DNR-322L and DNR-326 Multiple Security Vulnerabilities

An attacker can exploit this issue using readily available tools.

The researcher who discovered these issues has created proof-of-concepts. Please see the references for more information.

D-Link DNR-322L and DNR-326 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

D-Link DNR-322L and DNR-326 Multiple Security Vulnerabilities

References:

• D-Link Homepage (D-Link)
  
• Vulnerabilities in D-Link network video recorders enable remote spying, research (PC World Article)
  
• DNR-322L/DNR-326 Rev. Ax - Multiple Vulnerabilities - F/W 1.x and Older (D-Link)