D-Link does not fix security hole after months

By on July 2, 2006, 3:40 AM
An interesting report on Dailytech indicates that a critical security hole affecting certain D-Link routers remains unfixed after several months, with little to no sign that the company plans to update the products' firmware and resolve the problem. The affected products are: DI-524 (Wireless), DI-604*, DI-624 (Wireless), DI-784* (Wireless), EBR-2310*, WBR-1310 (Wireless), WBR-2310 (Wireless). * Denotes firmware update available.

The vulnerability allows remote code to be executed through the routers firmware potentially leaving affected customers vulnerable to attack. The vulnerability can give an attacker complete control over any and all network traffic.
This is a very serious issue being overlooked by one of the largest home router providers. Reportedly, the bug only affects the LAN part of the router, however because some of them offer wireless capabilities, there is still room for compromising the connection.




User Comments: 6

Got something to say? Post a comment
canadian said:
Awwww no. I have the DI-624!!! Well, I hope I dont get a hacker after me.
Nancy Jameson said:
lol no surprise. They also copied the Spam Cube (www.spamcube.com) product and called it "securespot" Its funny how tech companies are getting away with this stuff and now theyre answering options probes, SEC inquiry anyone?
pikaj00 said:
kinda makes me glad that i have a linksys WRT54GS with DD-WRT firmware instead of being forced to use the manufacturer's firmware, which more often than not is way out of date. then again, most likely you can partially avoid the exploit by turning on AP isolation if you have wireless. if you allow wrongdoers to connect via ethernet to your router.... thats your problem :Dlooks like ill have to tell my friend about this... he has a 604 i think.
DragonMaster said:
I have 624, with wireless disabled.604 isn't wireless AFAIK so the vulnerability isn't a big problem unless he downloads anything.
pikaj00 said:
[b]Originally posted by DragonMaster:[/b][quote]I have 624, with wireless disabled.604 isn't wireless AFAIK so the vulnerability isn't a big problem unless he downloads anything.[/quote]well, the article states its only a LAN-side exploit, so wether he downloads anything or not is irrelevant. the problem is that he allows somewhat malicious individuals (his other friends) to go on his network without any sort of protection on his computer or other computers already on the network. luckily its not wireless as you said, but in this case it doesnt matter since he lets morons on his network who like to cause trouble. in a way i hope they DONT fix it, because that just makes people all the more willing to find a way to force linux on d-link routers like dd-wrt did with the wxworks versions of the linksys WRT54G/GS.
Sir_Brizz said:
For anyone interested, many D-Link products received a firmware update today, including the WBR-2310 which attempts to fix this exploit.I do have to say, though, that anyone dumb enough to let someone on their LAN that would do something like this deserves for it to happen to them.
Load all comments...

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.