A serious Vulnerability Found In D-Link Routers

The hacker group, which specializes in embedded electronics, has found a vulnerability in the popular home routers D-Link, with help which to the management unit may be allowed an unauthorized user.

The vulnerability, which opens access to the administrator's Web interface allows you to monitor a number of custom functions in the popular routers DIR-100, DI- 524, DI-524UP, DI-604S, DI-604UP, DI-604 and TM-G5240. According to the resource / dev/ttys0, several lineup Planex routers are vulnerable, since they use the same system firmware.

The report said that in order to gain access to the management of the router without a password the user needs to open the login screen and enter a user name in the column sequence xmlset_roodkcableoj28840ybtide.


Experts say that the so-called User Agent in the mini- server, a router uses a simple algorithm for sequences for granting or refusing authorization. For example, if an input sequence of calls check_login and that either skips function alpha_auth_check, or returns the parameter 1, the router sets in the management interface and without a password.

Members / dev/ttys0 disagree whether such a weak implementation of rough flaw D-Link or is it deliberately created a backdoor engineering. Also, the developers of the resource say that it was they who created the exploit against this bug.