[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FD] New CSRF vulnerabilities in D-Link DAP-1360

Hello list!

After previous Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities, here are new ones. There are Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 (Wi-Fi Access Point and Router).

Affected products:

Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model with other firmware versions also must be vulnerable.

D-Link should fix these vulnerabilities in the next version of firmware, as they answered me in October 2014.

I tested model DAP-1360/B/D1B. There are three models of DAP-1360:

DAP-1360/B1A (f/w ver 2.xx) - D-Link will not add fixes, it's EOL device.
DAP-1360/B/D1B (f/w ver 1.x.x - 2.x.x) - D-Link should possibly fix the vulnerabilities in new firmware. DAP-1360/A/E1A (f/w ver 2.5.4 or later) - the first public firmware possibly includes fixes for the vulnerabilities.



In section Wi-Fi - WPS it's possible to change parameter WPS Enable:

Turn on:{%22wps%22:{%22WscEnable%22:true,%22WscConfigured%22:true}}

Turn off:{%22wps%22:{%22WscEnable%22:false,%22WscConfigured%22:true}}

Reset to unconfigured:{%22wps%22:{%22WscEnable%22:true,%22WscConfigured%22:false}}

It's possible to read configuration in Information - Refresh. From this page it's possible to read data about Encryption key via XSS attack (it will work even at turned off WPS):

It's possible to change method in Connection - WPS Method:




2014.05.22 - informed developers about vulnerabilities in D-Link DAP-1360.
2014-2016 - informed developers about multiple vulnerabilities in this and other D-Link devices.
2016.01.27 - disclosed at my site (http://websecurity.com.ua/8120/).

Best wishes & regards,
Administrator of Websecurity web site

Sent through the Full Disclosure mailing list
Web Archives & RSS: http://seclists.org/fulldisclosure/