Hackers Can Access Web Interface of Some D-Link Routers

[Matsuda]

Security researchers from Tactical Network Solutions warn that hackers can easily gain access to the web interfaced of some D-Link routers due to a vulnerability in the firmware.

The following D-Link routers are said to be impacted: DIR-100, DI-524, DI-524UP, DI-604S, and DI-604UP, DI-604 +, TM-G5240 and possibly some versions of DIR-615. A couple of Planex routers, namely BRL-04UR and BRL-04CW, use the same firewall.

Experts have found that anyone can access a router’s interface without knowing its password simply by changing the browser’s user agent string to “xmlset_roodkcableoj28840ybtide”. A number of users have confirmed being able to reproduce the attack.

It’s uncertain if D-Link is aware of this issue and if the company plans on doing anything about it.

Additional technical details are available on /DEV/TTYS0.




Source

[emerglines]

Lol! i did this haha!!! was cool, i can access the internal IP range, but i just inform the owner about that to close his panel...

[nanoman]

Lol! i did this haha!!! was cool, i can access the internal IP range, but i just inform the owner about that to close his panel...

I think You Gain Access In the First Place because of router default password & Option Remote management control Was Enabled In router>Right Correct me If I'm Wrong

I'm N00B In such Things But Can you Tell How Did You Gain Access To Internal ip rang " private ip " Again Don't laugh @ me I'm N00B & I admit :P

You Can Pm Me If You Can't Post Here Because Of the Rules

[emerglines]

Lol! i did this haha!!! was cool, i can access the internal IP range, but i just inform the owner about that to close his panel...

I think You Gain Access In the First Place because of router default password & Option Remote management control Was Enabled In router>Right Correct me If I'm Wrong

I'm N00B In such Things But Can you Tell How Did You Gain Access To Internal ip rang " private ip " Again Don't laugh @ me I'm N00B & I admit :P

You Can Pm Me If You Can't Post Here Because Of the Rules

Nope! i did some BOF stuff :)

Learn networking bro, and don't ask me how i do it, learn and then you can done stuff :)

Edited October 14, 2013 by emerglines

[nanoman]

Nope! i did some BOF stuff :)

Learn networking bro, and don't ask me how i do it, learn and then you can done stuff :)

thanks For The Response , But any even Small Detail or Hint Would Be Appreciated ^_^

[emerglines]

Nope! i did some BOF stuff :)

Learn networking bro, and don't ask me how i do it, learn and then you can done stuff :)

thanks For The Response , But any even Small Detail or Hint Would Be Appreciated

Nah! i won't, learn to ask google for stuff :)

[nanoman]

Nah! i won't, learn to ask google for stuff :)

OK , "You have the right to remain silent. Anything you say can and will be used against you in a court of law. You have the right to an attorney"

:D :rofl: :rofl: :rofl: :rofl:

[emerglines]

Nah! i won't, learn to ask google for stuff :)

OK , "You have the right to remain silent. Anything you say can and will be used against you in a court of law. You have the right to an attorney"

:D :rofl: :rofl: :rofl: :rofl:

Yep! Forums law :)

[ricktendo]

Joel is suck a dick :doh:

Try to read the string xmlset_roodkcableoj28840ybtide backwards …. it appears as “Edit by 04882 joel backdoor“, very cool.

Edited October 14, 2013 by ricktendo