D-Link VPN Routers Get Patch For Remote Command Injection Bugs
A vulnerability in D-link firmware powering multiple routers with VPN passthrough functionality allows attackers to take full control of the device.
The bug affects router models DSR-150, DSR-250/N, DSR-500, and DSR-1000AC running firmware version 3.17 or below.
Run commands with root privileges
Reported by Digital Defense’s Vulnerability Research Team on August 11, the flaw is a root command injection that can be exploited remotely if the device’s “Unified Services Router” web interface is reachable over the public internet.
“Consequently, a remote, unauthenticated attacker with access to the router’s web interface could execute arbitrary commands as root, effectively gaining complete control of the router”
– Digital Defense
Hackers could use their access to intercept traffic, modify it, or target other connected devices in the house.
Also Read: Limiting Location Data Exposure: 8 Best Practices
D-Link has acknowledged the issue and published some details in an advisory earlier this month, saying that some LUA CGI are accessible without authentication and could be used to execute a LUA library function to pass user-supplied data.
The router manufacturer explains that an attacker can slip malicious data into a command designed to calculate a hash that is processed by the “os.popen()” function.
Following Digital Defense’s report, which referred only to DSR-250 router model, D-Link assessed that the vulnerable firmware version was powering the other models ( DSR-250/N, DSR-500, and DSR-1000AC).
For the impacted router models, D-Link has released a hotfix, the latest firmware version mitigating the problem being 3.17B401C.
Two more bugs, one left unpatched
Apart from this vulnerability, Digital Defense reported two others, none as severe. One of them is also a root command injection exploitable over an exposed “Unified Services Router” web interface but it requires authentication.
The third one is an authenticated crontab injection that allows scheduling the execution of arbitrary commands with root privileges.
D-Link did not acknowledge this bug, classifying it as low-threat after applying the patch for the other two issues. The company explains:
“For this generation of product, the device uses a plain text config, which is the design to directly edit and upload the config to the same DSR devices accordingly. If D-Link mitigates issue #1 and #2, as well as other, recently reported issues, the malicious user would need to engineer a way of gaining access to the device to upload a configuration file, so we understand the report but classify the report as low-threat once the patched firmware is available”
Also Read: 10 Practical Benefits of Managed IT Services
The table below lists vulnerable router models and links to the updated firmware version containing the fix:
Model | Hardware Revision | Region | Affected FW | Fixed FW | Recommendation | Last Updated | |
DSR-150 | All Rev. A Hardware Revision | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-150 | All Rev. A Hardware Revision | Russian | v3.17 & Below | v3.17B401C_RU | Download and Update Device | 12/02/2020 | |
DSR-150 | All Rev. C Hardware Revision | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-150 | All Rev. C Hardware Revision | Russian | v3.17 & Below | v3.17B401C_RU | Download and Update Device | 12/02/2020 | |
DSR-150N | All Rev. A Hardware Revision | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-150N | All Rev. A Hardware Revision | Russian | v3.17 & Below | v3.17B401C_RU | Download and Update Device | 12/02/2020 | |
DSR-150N | All Rev. C Hardware Revision | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-150N | All Rev. C Hardware Revision | Russian | v3.17 & Below | v3.17B401C _RU | Download and Update Device | 12/02/2020 | |
DSR-250 | All Rev. A Hardware Revisions | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-250 | All Rev. A Hardware Revisions | Russian | v3.17 & Below | v3.17B401C_RU | Download and Update Device | 12/02/2020 | |
DSR-250 | All Rev. C Hardware Revision | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-250 | All Rev. C Hardware Revision | Russian | v3.17 & Below | v3.17B401C_RU | Download and Update Device | 12/02/2020 | |
DSR-250N | All Rev. A Hardware Revisions | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-250N | All Rev. A Hardware Revisions | Russian | v3.17 & Below | v3.17B401C_RU | Download and Update Device | 12/02/2020 | |
DSR-250N | All Rev. B Hardware Revision | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-250N | All Rev. B Hardware Revision | Russian | v3.17 & Below | v3.17B401C _RU | Download and Update Device | 12/02/2020 | |
DSR-250N | All Rev. C Hardware Revision | Worldwide | v3.17 & Below | v3.17B401C_WW | Download and Update Device | 12/02/2020 | |
DSR-250N | All Rev. C Hardware Revision | Russian | v3.17 & Below | v3.17B401C_RU | Download and Update Device | 12/02/2020 |
0 Comments