Over the last few months, the cyber world witnessed an alarming spike in the number of malicious attacks, it's seen as a direct result of more and more people working from home. As organizations have been experiencing unprecedented cybersecurity challenges, it has become even more crucial for users to keep their networks updated and hence secured.
DIR-865L model of D-Link routers, designed for monitoring home network from anywhere, was found to be containing six vulnerabilities as follows:
1. CVE-2020-13782 [Improper Neutralization of Special
Elements used in a Command (Command Injection)]: A backend
engine known as cgibin.exe controls the web interface for this
router; attackers can place arbitrary code to be executed with
administrative privileges.
2. CVE-2020-13786 [Cross-Site Request Forgery
(CSRF)]: Threat actors can intercept data present on sections
under password protection by capturing the network traffic; the
router's web interface consists of various pages that are
vulnerable to this security flaw.
3. CVE-2020-13785 (Inadequate Encryption Strength): The attackers can learn a user's password via a brute force attack carried offline on the basis of information that's sent to the client from the router when the user logs into the SharePort Web Access portal in port 8181.
4. CVE-2020-13784 (Predictable Seed in Pseudo-Random Number
Generator): By exploiting this vulnerability, the attackers can
deduce the information required to perform CSRF attacks even if the
router is encrypting session information using HTTPS.
5. CVE-2020-13783 (Cleartext Storage of Sensitive
Information): When an attacker attempts to acquire the admin
password stored in the tools_admin.php page, he requires physical
access to a logged-on machine as credentials sent over the wire are
not clear. Once the attacker acquires physical access, he can view
the password via the HTML source of the page.
6. CVE-2020-13787 (Cleartext transmission of sensitive information): Attackers capturing network traffic and stealing data can access the password used for guest wifi network, it's done via an option 'Wired Equivalent Privacy' (WEP).
These 6 newly discovered vulnerabilities by Palo Alto Networks' Unit 42 researchers in the D-Link DIR-865L home wireless router can be exploited all at once to run arbitrary commands, delete information, upload malware, exfiltrate data or intercept information and obtain user credentials illicitly.
To stay protected against the session hijacking attacks, users are advised to default all traffic to HTTPS and stay updated with the latest available version of the firmware with fixes, one can find the firmware on the D-Link's website. The website also provides a 'how-to' tutorial for changing the time zone on the router for the users to further defend themselves from possible malicious attacks.
Read more https://www.ehackingnews.com/2020/06/six-new-vulnerabilities-found-in-dir.html
