Vulnerabilities in D-Link DSL-500T ADSL Router

Hello 3APA3A!

I want to warn you about security vulnerabilities in D-Link DSL-500T ADSL Router.

These are Predictable Resource Location, Brute Force and Cross-Site Request Forgery vulnerabilities. This is my first advisory from series of advisories about vulnerabilities in D-Link products.

Predictable Resource Location (WASC-34):

http://192.168.1.1

The control panel of modem is placed at default path with default login and password (admin:admin). Which allows for local users (which have access to PC or via LAN) and also for remote users via Internet (via CSRF) to get access to control panel and change router's settings.

Default above-mentioned settings - it's standard practice of developers of ADSL routers. But ISPs should make changes, but particularly ISP Ukrtelecom doesn't do it in modems Callisto (which he offers to his clients), at that ISP Intertelecom, which offered this DSL-500T to us in rent, exactly changed default password in control panel.

Brute Force (WASC-11):

In login form http://192.168.1.1 there is no protection against Brute Force attacks. Which allows to pick up password (if it was changed from default), particularly at local attack. E.g. via LAN malicious users or virus at some computer can conduct attack for picking up the password, if it was changed.

CSRF (WASC-09):

Lack of protection against Brute Force (such as captcha) also leads to possibility of conducting of CSRF attacks, which I wrote about in the article Attacks on unprotected login forms (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-April/007773.html). It allows to conduct remote login. Which will be in handy at conducting of attacks on different CSRF and XSS vulnerabilities in control panel. Which quite can be in it, as I can say based on vulnerabilities in other D-Link device, which I've bought in November 2011, and also based on holes in Iskra Callisto 821+.

Vulnerable is the next model: D-Link DSL-500T ADSL Router.

I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/5554/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua