lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 30 Nov 2016 23:43:11 +0200
From: "MustLive" <>
To: <>,
Subject: [FD] New CSRF vulnerabilities in D-Link DAP-1360

Hello list!

After previous Cross-Site Request Forgery and Cross-Site Scripting 
vulnerabilities, here are new ones. There are Cross-Site Request Forgery 
vulnerabilities in D-Link DAP-1360 (Wi-Fi Access Point and Router).

Affected products:

Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model 
with other firmware versions also must be vulnerable.

D-Link should fix these vulnerabilities in the next version of firmware, as 
they answered me in October 2014.

I tested model DAP-1360/B/D1B. There are three models of DAP-1360:

DAP-1360/B1A (f/w ver 2.xx) - D-Link will not add fixes, it's EOL device.
DAP-1360/B/D1B (f/w ver 1.x.x - 2.x.x) - D-Link should possibly fix the 
vulnerabilities in new firmware.
DAP-1360/A/E1A (f/w ver 2.5.4 or later) - the first public firmware possibly 
includes fixes for the vulnerabilities.



In section Wi-Fi - WPS it's possible to change parameter WPS Enable:

Turn on:{%22wps%22:{%22WscEnable%22:true,%22WscConfigured%22:true}}

Turn off:{%22wps%22:{%22WscEnable%22:false,%22WscConfigured%22:true}}

Reset to unconfigured:{%22wps%22:{%22WscEnable%22:true,%22WscConfigured%22:false}}

It's possible to read configuration in Information - Refresh. From this page 
it's possible to read data about Encryption key via XSS attack (it will work 
even at turned off WPS):

It's possible to change method in Connection - WPS Method:




2014.05.22 - informed developers about vulnerabilities in D-Link DAP-1360.
2014-2016 - informed developers about multiple vulnerabilities in this and 
other D-Link devices.
2016.01.27 - disclosed at my site (

Best wishes & regards,
Administrator of Websecurity web site 

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists