bugtraq - Re: OS-Command Injection via UPnP Interface in multiple D-Link devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201307081616.r68GGlCa023338@sf01web1.securityfocus.com>
Date: Mon, 8 Jul 2013 16:16:47 GMT
From: krlovett@...il.com
To: bugtraq@...urityfocus.com
Subject: Re: OS-Command Injection via UPnP Interface in multiple D-Link
 devices

I can concur these issues exist in several other models as well. In fact, on any UPnP enabled D-Link from 868L and down, merely selecting "Display Hidden Elements" inside the developer tool bar, will expose the entire administrative GUI.

Additional models I found the same bug, though I'm so sure that the latest firmware completely fixes the issues.

Wireless AC1200 Dual Band Gigabit Cloud Router DIR-850L
Wireless AC1200 Dual Band Gigabit Cloud Router DIR-860L
Wireless N150 Home Router DIR-601
Wireless N 8-Port Router DIR-632