To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"D-Link DSR-250N 3.12 - Denial of Service (PoC)"

Author

Exploit author

"RedTeam Pentesting GmbH"

Platform

Exploit platform

hardware

Release date

Exploit published date

2020-10-08

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
# Exploit Title: D-Link DSR-250N 3.12 - Denial of Service (PoC)
# Google Dork: N/A
# Author: RedTeam Pentesting GmbH
# Date: 2020-10-03
# Exploit Author: Kiko Andreu (kikoas1995) & Daniel MonzΓ³n (stark0de)
# Vendor Homepage: https://www.dlink.com
# Software Link: https://www.dlink.com/en/products/dsr-250n-wireless-n-unified-service-router
# Version: 3.17B
# CVE : CVE-2020-26567

Advisory: Denial of Service in D-Link DSR-250N

RedTeam Pentesting discovered a Denial-of-Service vulnerability in the
D-Link DSR-250N device which allows unauthenticated attackers in the
same local network to execute a CGI script which reboots the device.


Details
=======

Product: D-Link DSR-250N
Affected Versions: 3.12 and potentially later
Fixed Versions: 3.17B
Vulnerability Type: DoS
Security Risk: low
Vendor URL: https://www.dlink.com/en/products/dsr-250n-wireless-n-unified-service-router
Vendor Status: notified
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2020-002
Advisory Status: published
CVE: CVE-2020-26567
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26567


Introduction
============

"The D-Link Wireless N Unified Service Router (DSR-250N) provides
enhanced security, functionality and performance over a traditional VPN
router without the complexity of a full firewall solution. The D-Link
Wireless N Unified Service Router is a cost-effective, high performance
solution for securing a small business network."

(from the vendor's homepage)


More Details
============

During a penetration test, the firmware for the D-Link DSR-250N router
was downloaded from D-Links official website[1] and extracted for
further analysis. It was then confirmed that CGI scripts exist on the
router that can be directly accessed with a web browser, without any
authentication. In particular, the script "upgradeStatusReboot.cgi"
executes the command to reboot the device. Its contents are:

------------------------------------------------------------------------
#!/bin/sh
echo Content-type: text/plain
echo ""
stat=`/sbin/reboot -d 8 &`
echo $stat
------------------------------------------------------------------------

Executing this script renders the device unusable for the time of the
reboot. In tests, it turned out that the device needs roughly four
minutes to complete a reboot. As a consequence, any network using the
device as a switch or router is not accessible during that time, too.

In the penetration test, the router's web interface was available
directly over the Internet. According to the vendor, the web interface
is by default disabled for the WAN interface.


Proof of Concept
================

An HTTP GET request to the CGI script "upgradeStatusReboot.cgi" will
reboot the device:

------------------------------------------------------------------------
$ curl -k -s https://IP-ADDRESS/scgi-bin/upgradeStatusReboot.cgi
------------------------------------------------------------------------


Workaround
==========

Access to the D-Link DSR-250N's web interface should only be enabled for
administrators, for example by only allowing access from specific IP
addresses in the firewall. Access over the WAN interface should also be
disabled if it was enabled manually.


Fix
===

A preview firmware version named 3.17B which should correct the issue
was received at the end of September from the vendor. RedTeam Pentesting
was not able to verify the fix due to lack of access to a test device.
However, the formerly accessible CGI script is no longer part of the
firmware.


Security Risk
=============

No authentication is needed to excute the CGI script and thereby reboot
the device. Attackers might abuse this behaviour for targeted
denial-of-service-attacks against D-Link customers, since rebooting the
device interrupts access to networks relying on this device for routing
or switching purposes. However, the attack is only possible if the
attacker resides on the same network, and no further information can be
gathered or control over the devices be obtained. Therefore, the
vulnerability is rated as a low risk.


Timeline
========

2020-06-29 Vulnerability identified
2020-07-03 Customer approved disclosure to vendor
2020-07-03 Requested security contact from vendor via web formular
2020-07-03 Vendor replied with contact information
2020-07-07 Advisory provided to vendor
2020-09-28 Vendor provided fixed version to RedTeam Pentesting
2020-10-05 CVE ID requested
2020-10-06 CVE ID assigned
2020-10-08 Advisory released


References
==========

[1] https://support.dlink.com/ProductInfo.aspx?m=DSR-250N


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/


Working at RedTeam Pentesting
=============================

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "AydΔ±n Baran Ertemir"
Release Date Title Type Platform Author
2020-11-30 "ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure" webapps hardware "Zagros Bingol"
2020-11-30 "Intelbras Router RF 301K 1.1.2 - Authentication Bypass" webapps hardware "Kaio Amaral"
2020-11-27 "Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution" webapps hardware "Emre SUREN"
2020-11-24 "Seowon 130-SLC router 1.0.11 - 'ipAddr' RCE (Authenticated)" webapps hardware maj0rmil4d
2020-11-23 "TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass" webapps hardware malwrforensics
2020-11-19 "Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure" remote hardware "Nitesh Surana"
2020-11-19 "Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification" webapps hardware "Ricardo Longatto"
2020-11-16 "Cisco 7937G - DoS/Privilege Escalation" remote hardware "Cody Martin"
2020-11-13 "ASUS TM-AC1900 - Arbitrary Command Execution (Metasploit)" webapps hardware b1ack0wl
2020-11-13 "Citrix ADC NetScaler - Local File Inclusion (Metasploit)" webapps hardware "RAMELLA Sebastien"
Release Date Title Type Platform Author
2020-11-18 "BigBlueButton 2.2.25 - Arbitrary File Disclosure and Server-Side Request Forgery" webapps multiple "RedTeam Pentesting GmbH"
2020-10-08 "D-Link DSR-250N 3.12 - Denial of Service (PoC)" webapps hardware "RedTeam Pentesting GmbH"
2020-03-12 "WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure" webapps java "RedTeam Pentesting GmbH"
2016-12-23 "Apache mod_session_crypto - Padding Oracle" webapps multiple "RedTeam Pentesting GmbH"
2016-06-02 "Websockify (C Implementation) 0.8.0 - Buffer Overflow (PoC)" dos multiple "RedTeam Pentesting GmbH"
2016-06-02 "Relay Ajax Directory Manager relayb01-071706/1.5.1/1.5.3 - Arbitrary File Upload" webapps php "RedTeam Pentesting GmbH"
2014-05-28 "webEdition CMS - 'we_fs.php' SQL Injection" webapps php "RedTeam Pentesting GmbH"
2013-05-07 "Dovecot with Exim - 'sender_address' Remote Command Execution" remote linux "RedTeam Pentesting GmbH"
2011-12-15 "Owl Intranet Engine 1.00 - 'userid' Authentication Bypass" webapps php "RedTeam Pentesting GmbH"
2011-03-15 "SugarCRM 6.1.1 - Information Disclosure" webapps php "RedTeam Pentesting GmbH"
2011-03-05 "nostromo nhttpd 1.9.3 - Directory Traversal Remote Command Execution" remote linux "RedTeam Pentesting GmbH"
2010-01-27 "Geo++ GNCASTER 1.4.0.7 - GET Denial of Service" dos linux "RedTeam Pentesting GmbH"
2010-01-27 "Geo++ GNCASTER 1.4.0.7 NMEA-data - Denial of Service" dos linux "RedTeam Pentesting GmbH"
2009-08-10 "Papoo 3.x - Upload Images Arbitrary File Upload" webapps php "RedTeam Pentesting GmbH"
2009-05-05 "IceWarp Merak Mail Server 9.4.1 - 'item.php' Cross-Site Scripting" webapps php "RedTeam Pentesting GmbH"
2009-05-05 "IceWarp Merak Mail Server 9.4.1 - 'Forgot Password' Input Validation" webapps php "RedTeam Pentesting GmbH"
2009-05-05 "IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting" webapps php "RedTeam Pentesting GmbH"
2007-09-17 "Alcatel-Lucent OmniPCX Enterprise 7.1 - Remote Command Execution" webapps cgi "RedTeam Pentesting GmbH"
2007-07-03 "Fujitsu ServerView 4.50.8 - DBASCIIAccess Remote Command Execution" remote multiple "RedTeam Pentesting GmbH"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48863/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.