A security researcher has shamed D‑Link by publicly disclosing 10 serious, as-yet unpatched vulnerabilities in a line of consumer-grade routers without notifying the vendor first.
Security researcher Pierre Kim went public on a series of flaws in D‑Link DIR 850L wireless AC1200 dual-band gigabit cloud routers without disclosing the issue to D‑Link beforehand because of a previous negative experience with the firm. He disclosed nine vulnerabilities to D‑Link back in February, but only one of them resulted in a patch from the manufacturer.
The D‑Link 850L zero-day flaws disclosed this week include a lack of adequate protection of firmware images, a shortcoming that means hackers could push malicious copies containing a backdoor onto targeted devices, flaws in the custom mydlink cloud protocol, and more. In an advisory, the security researcher also found remote code execution flaws, default private keys and a DDoS risk. Cross-site scripting (XSS), credentials stored in cleartext, and a Lan backdoor also feature.
“The D‑Link 850L is a router overall badly designed with a lot of vulnerabilities,” Kim offers in a somewhat dismissive summary seemingly borne out of exasperation with the networking kit maker.
“Basically, everything was pwned, from the Lan to the Wan.”
Source: The Register