14 DAY TRIAL // A security hole that affects certain D-Link DIR-300 and DIR-600 routers can be leveraged by hackers to execute arbitrary code at root level.
According to Michael Messner, the security researcher who has identified the vulnerability, the issue is caused by missing access restrictions and missing input validation in the cmd parameter.
In addition, the expert has found that administrator passwords are store in plain text.
Cybercriminals can also easily modify passwords since the current password is not required during the process. The only requirement is for the attacker to have access to an authenticated browser.
Experts from heise Security have also analyzed Messner’s findings. They say that many D-Link routers can also be compromised via the Internet.
This could be used by cybercriminals to redirect all the Internet traffic to an arbitrary server.
D-Link has been notified of the problem, but the company doesn’t plan on doing anything about it, arguing that “this is a security problem from the user and/or browser.”