lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 19 May 2005 14:11:55 +0200
From: Francesco Orro <>
Subject: D-Link DSL routers authentication bypass

====================== SUMMARY ========================

          Title: D-Link DSL routers authentication bypass
           Date: 19 May 2005
         Author: Francesco Orro <francesco.orro 4t>

        Product: DSL-502T, DSL-504T, DSL-562T, DSL-G604T
         Vendor: D-Link
     Vendor URL:
  Vendor Status: D-Link was conctacted
        Affects: Tested on DSL-502T, DSL-504T, DSL-562T, DSL-G604T with
                 various firmwares versions
           Risk: High
         Impact: Unauthorized people may gain full access to the device

Vulnerability Description: an undocumented feature allows (in some
cases) to bypass the authentication prompt and gain full access to the
router, and than to the network behind it.

====================== BACKGROUND ========================

D-Link DSL routers are commonly used for internet connectivity for home
or small office needs. (

=============== PROBLEM DESCRIPTION ==================

The CGI /cgi-bin/firmwarecfg, when executed, checks the existence of the
file fw_ip under /var/tmp/. If this file exists, all IP addresses listed
inside it are given straight access to the device, without the need for
authentication. If this file doesn't exists, the CGI creates a new one,
putting the requesting address inside.

If the web configuration console is accessible from internet and if
nobody have never called the CGI before (es: from a workstation inside
the LAN), then everybody can gain access to the router, download the
config.xml file which contains users account and passwords, have access
to the private network, modify or alter the firmware of the router, etc.

================ ADDITIONAL DETAILS ==================

Vulnerability was found on the following firmware versions:


Can be exploited by a simple HTTP POST with the form:

<head>Download config.xml:<title>GetConfig - Config file 

<script lang="javascript">
function invia_richiesta()

<form name="InputBox">
<br>http://<input Name="Host" type="text" value="">/cgi-bin/firmwarecfg<br>
<form name="DownloadConfig" method="POST" action="" 
          <input type="Submit" name="config" value="Download" 


=================== FIX INFORMATION ===================

Actually there is no solution to problem due to the fact that it seems
an hidden feature.
The work around is to call the CGI /cgi-bin/firmwarecfg from a known
address of the local network and/or disable web console access from the

================ AUTHOR INFORMATION ================

Francesco Orro
Akhela S.r.l. - Operation Group

EMail: francesco.orro 4t
KeyID: 6CF46D45

=================== DISCLOSURE HISTORY =====================

 2 May 2005 - First private release of this advisory;
 4 May 2005 - The vendor (D-Link Mediterraneo S.r.l.) has been informed
              of the vulnerability;
 5 May 2005 - The vendor replid that the problem was resolved on
              firmware version V1.00B02T02.EU.20040610, but has been
              demostrated that this version is vulnerable too;
19 May 2005 - Public release of this advisory.

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists