Overview

The Several of D-Link's Wireless Routers contains a vulnerability that allows a malicious user to escalate privilege using normally unprivileged HNAP commands.  This allows them to inject arbitrary commands into the router.

References

Zhang Wei (Qihoo360 ADLAB) (Link to follow)

 

Description

An attacker who wishes to gain access to the router sends an unprivileged HNAP command such as GetDeviceSettings, they append to the command an additional command separated with an "/", which is used as a separator between commands.  Any command(s) after the first will be executed unauthenticated.  Additionally, additional commands will be passed directly to the underlying Linux system, allowing the injection of arbitrary system commands.

The GetDeviceSettings HNAP Command is used to indicate some very common parameters (e.g. the domain name of the HNAP device), as well as to define which HNAP commands are available.

 

Affected Product  

 

Security patch for your D-Link Devices

These firmware updates address the security vulnerabilities in affected D-Link devices. D-Link will update this continually and we strongly recommend all users to install the relevant updates.

As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the underside of the product next to the serial number. Alternatively, they can also be found on the device web configuration.