lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 1 Jan 2018 12:45:36 +0200
From: Maor Shwartz <>
Cc: SecuriTeam Secure Disclosure <>
Subject: [FD] SSD Advisory – D-Link DSL-6850U Multiple Vulnerabilities

SSD Advisory – D-Link DSL-6850U Multiple Vulnerabilities

Full report:
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD

Vulnerabilities Summary
The following advisory describes two (2) vulnerabilities found in D-Link
DSL-6850U versions BZ_1.00.01 – BZ_1.00.09.

D-Link DSL-6850U is a router “manufactured by D-Link for Bezeq in Israel”
The vulnerabilities found are:

Default Credentials
Remote Command Execution

An independent security researcher has reported this vulnerability to
Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor response
Bezeq was informed of the vulnerability on June 9, and released patches to
address these vulnerabilities.

Vulnerabilities details
The device has a custom firmware with the following issues:

The Remote Web Management is enabled by default
The default account cannot be disabled

Default Credentials
The default account username is:

The password is:

Remote Command Execution
The shell interface allows only a set of commands however you can “bind”
them using ‘&&’ ‘||’

Sending the command to the shell:


echo && /bin/bash


Will result in a BusyBox shell

Maor Shwartz
Beyond Security
GPG Key ID: 6D273779F52A9FC2

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists