Overview

The D-Link DAP1522 IEEE 802.11n Multimedia Bridge firmware contains hard-coded Telnet Credentials that allow access to configuration. These vulnerabilities allows an attacker, can get access to the configration, which allows the ability to change configuration or cause the product to be unreliable.

D-Link Security Incident Reponse Policy

All public communication on this issue will be offered at http://securityadvisories.dlink.com/security/

Our security response team can be contacted for incident information or to report incidents at security@dlink.com

Any non-critical security issue, help in updating firmware, or configuration regarding this issue please contact your D-Link Customer care channel.

Reference

 
Matteo Ingnaccolo - Disclosure - November 27, 2013 - http://bit.ly/IqxzHj

OSVDB - ID#100442 - December 2, 2013 - http://osvdb.org/100442

General Disclosure

Security and performance is of the utmost importance to D-Link across all product lines. This is not just through the development process but also through regular firmware updates to comply with the current safety and quality standards. We are proactively working with the sources of these reports as well as continuing to review across the complete product line to ensure that the vulnerabilities discovered are addressed.  We will continue to update this page to include the relevant product firmware updates addressing these concerns. In the meantime, you can exercise the below cautions to avoid unwanted intrusion into your D-Link product.

Immediate Recommendations for all D-Link router customers

• If you receive unsolicited e-mails that relates to security vulnerabilities and prompt you to action, please ignore it. When you click on links in such e-mails, it could allow unauthorised persons to access your device. Neither D-Link nor its partners and resellers will send you unsolicited messages where you are asked to click or install something.
• Make sure that your wireless network is secure.
• Do not provide your admin password to anyone. If required we suggest updating the password frequently.

Details

The DAP-1522 has hard-coded Telnet credentials that may allow mallicious attacker access to the device and modify it's configuration.

Root Cause and Correction

The telnet daemon allows manufacturing to WiFi calibrate and set factory defaults during production.

The telnet dameon will be removed so no further abuse or risks can occur.

In order to comply and close these vulnerability D-Link has release new firmware that corrects this vulnerability.

Effected Products

Model Name	HW Version	Current FW Version	New FW Version for this exploit fix
DAP-1522	Ax & Bx	Ax: 1.41 Bx: 2.03	Ax: v1.42b01 Bx v2.07b01

Security patches for your D-Link Product

These firmware updates address the security vulnerabilities in affected D-Link products. D-Link will update this continually and we strongly recommend all users to install the relevant update.

As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the underside of the product next to the serial number. Alternatively, they can also be found on the device web configuration.

To update the firmware please log-in to the Web-GUI interface of your DAP-1522, from the menu select Maintanence -> System -> Upgrade Firmware. If you require help please contact your regional D-Link customer care website for options.