Overview
D-Link wired/wireless routers have WiFi Protected Setup (WPS), also frequently called WiFi Push-Button Setup, default enabled. WPS provides end-users a simple way to pair/connect to a secured netowrk already functioning. WPS pairing can be triggered by pressing the WPS buttons on the router and the device. WPS can also be paired by knowing a defualt PIN located in the web-configuraiton page on the router. Recently, one of our router's firmware was reversed engineered and the algoritm that creates the factory default WPS-PIN code was disclosed. This means a malicious users could use information provided from the router to decode and gain access to the WiFi side of the device. See Recommendations below for immediate action.
Source
Craig of /dev/ttys0 : Link
Hack-a-Day: Link
Details
In order to maintain the integrity of the initial disclosure of the vulnerability we refer you to the links in the Source section.
Recommendations
D-Link recommends to take immediate actions to protect your network. We will release firmware to correct these issues. Until new patches are available, implementing either recoomendation will close this exploit.
Option 1: Change the default WPS-PIN - This will allow you continue use of WPS feature securely.
1. Open device’s management UI, by accessing router’s IP. Usually http://192.168.0.1/
2. After login using administrator’s password, navigating to Advanced -> Wireless Protected Setup.
3. Click the “Generate New PIN” to form a new PIN code.
4. Hit “Save Settings”.
Option 2: Disable WPS feature - This will disable the use of WPS feature, which may lead to issues connecting new devices to your network that require WPS.
1. Open device’s management UI, by accessing router’s IP. Usually http://192.168.0.1/
2. After login using administrator’s password, navigating to Advanced -> Wireless Protected Setup.
3. Deselect/Un-Check the “Enabled” in the Wi-Fi Protected Setup section
4. Hit “Save Settings”.
Affected Product
|
Model Name
|
HW Version
|
Current FW Version
|
New FW Version for this exploit fix
|
| DAP-1350 |
Ax |
All
|
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
|
DAP-1555
|
Ax
|
All
|
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DGL-4500 |
Ax |
All
|
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DHP-1320 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-451 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-601 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-615 |
Bx, Cx, Ex |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-628 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-632 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-636L |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-651 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-655 |
Ax, Bx |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-657 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-808L |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-810L |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-825 |
Ax, Bx |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-826L |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-827 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-835 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-836L |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-855 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
| DIR-857 |
Ax |
All |
FW: Under Invesitgation
Please Use Recommendations
(Updated 10/31/2014)
|
Security patch for your D-Link Devices
These firmware updates address the security vulnerabilities in affected D-Link devices. D-Link will update this continually and we strongly recommend all users to install the relevant updates.
As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the underside of the product next to the serial number. Alternatively, they can also be found on the device web configuration.