D-Link to padlock router backdoor by Halloween

The backdoor lets attackers change a router configuration without authenticating

D-Link will address by the end of October a security issue in some of its routers that could allow attackers to change the device settings without requiring a username and password.

The issue consists of a backdoor-type function built into the firmware of some D-Link routers that can be used to bypass the normal authentication procedure on their Web-based user interfaces.

Craig Heffner, a vulnerability researcher with Tactical Network Solutions, discovered and publicly reported the issue.

"If your browser's user agent string is 'xmlset_roodkcableoj28840ybtide' (no quotes), you can access the web interface without any authentication and view/change the device settings," he wrote Saturday in a blog post.

When read in reverse, the last part of this hard-coded value is "edit by 04882 joel backdoor."

D-Link will release firmware updates to address the vulnerability in affected routers by the end of October, the networking equipment manufacturer said via email.

The updates will be listed on a security page on the D-Link website and in the download section of the support page for each affected product.

The company did not clarify why the backdoor was placed in the firmware in the first place or what router models are affected.

According to Heffner, the affected models likely include D-Link's DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+, TM-G5240 and possibly DIR-615. The BRL-04UR and BRL-04CW routers made by Planex Communications might also be vulnerable because they also appear to use the same firmware, he said.

The risk of unauthorized access is higher for routers that have been configured for remote management and have their Web administration interface exposed to the Internet.

However, even when the interface is only accessible from the internal network -- the default setting in D-Link routers -- this backdoor can still pose a threat because any visitor who connects to the wireless network or any piece of malware running on a computer inside the network can exploit it to make unauthorized changes to the router's configuration.

Such changes can have serious security consequences. For example, changing the DNS (Domain Name System) servers used by the router -- and inherently every device on the network -- with DNS servers controlled by an attacker would enable the attacker to redirect users to rogue websites when trying to access legitimate ones.

"Owners of affected devices can minimize any potential risk by ensuring that their router has the Wi-Fi password enabled and that remote access is disabled," D-Link said.

"If you receive unsolicited e-mails that relate to security vulnerabilities and prompt you to action, please ignore it," the company said. "When you click on links in such e-mails, it could allow unauthorized persons to access your router. Neither D-Link nor its partners and resellers will send you unsolicited messages where you are asked to click or install something."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags patchesTactical Network SolutionsNetworkingsecurityAccess control and authenticationroutersD-LinkExploits / vulnerabilitiesnetworking hardware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?