Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[GreenBay42]

New firmware has been released for both revision A and B. This fixes several security exploits.

The ZIP file will contain 2 firmware files. Please read the instructions before upgrading the firmware. You must upgrade the 2 files in order and then reset the router back to factory default settings so make note of your settings before upgrading.

Rev A

Firmware -> ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-850L/REVA/DIR-850L_REVA_FIRMWARE_PATCH_v1.20B03.zip

Rev B

Firmware --> ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-850L/REVB/DIR-850L_REVB_FIRMWARE_PATCH_v2.20B03.zip


Release Notes:

Problems Resolved:
1. Fixed the security issues reported by Pierre Kim on Sept. 8th, 2017.

• Firmware Protection
• WAN && LAN - XSS exploit
  (CVE-2017-14413, CVE-2017-14414, CVE-2017-14415, CVE-2017-14416)
• WAN - Weak Cloud protocol
  (CVE-2017-14419, CVE-2017-14420)
• WAN && LAN - Stunnel private keys
  (CVE-2017-14422)
• WAN && LAN - Nonce brute forcing for DNS configuration
  (CVE-2017-14423)
• Local - Weak files permission and credentials stored in clear text
  (CVE-2017-14424, CVE-2017-14425, CVE-2017-14426, CVE-2017-14427, CVE-2017-14428)
  
• LAN – DoS attack against some daemons
  (CVE-2017-14430)

[lescarlson]

"You must upgrade the 2 files in order and then reset the router back to factory default settings so make note of your settings before upgrading."

"so make note of your settings before upgrading."... Does this mean you can't use the routers save config feature?
"and then reset the router back to factory default"... Does this mean the reset must be done manually?

[FurryNutz]

Please factory reset the router before sending the 1st update file. Then send the 2nd file. Factory reset once more after the 2nd file was processed by the router then set up from scratch. After router is set up, save the router config to a new file.

There is differences between your current version and this new one which the old config file may be incompatible and cause problems. So set up from scratch and then save a new file. Take notes or screen captures of your current router settings before starting the FW update process.

Use IE11 or FF browsers. Do not use Chrome!

"You must upgrade the 2 files in order and then reset the router back to factory default settings so make note of your settings before upgrading."

"so make note of your settings before upgrading."... Does this mean you can't use the routers save config feature?
"and then reset the router back to factory default"... Does this mean the reset must be done manually?

[lescarlson]

Immediately after installing this 1.20 / 2.20 HW B security fix (both files according to instructions) the 850L lost internet connection momentarily and again once every 5 minutes. It would reconnect then lose its connection exactly 5 minutes later and so on and so on. Any stream occurring would halt and would have to be restarted again manually from the app or streaming device. I am connected to a DSL modem via a 'DHCP dynamic ip' connection. Before the 1.20 / 2.20 security firmware the router worked perfectly. Careful screen shots were taken prior to the update to reconfigure.

I have since set up the router using the currently assigned IP address as a 'Static' address. Doing this has completely solved the "5 minute disconnect" thing. This is all well and good except when my ISP provider changes my dynamic IP address (which happens irregularly about 2wice a month) the router will lose its connection and the newly  assigned address will have to be reconfigured as a static address in the 850L router again.

Has any one else experienced this? Is this some thing D-link is aware of?

[FurryNutz]

Was a factory reset performed after the last file was process then set up from scratch and don't load a saved configuration from file?

What is the Mfr and model of the ISP modem?

• For DSL/PPPoE connections on the router, ensure that "Always ON" option is enabled.
• If the ISP modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT and How NAT Works. Call the ISP and ask to see if the ISP modem can be bridged. To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ. Also check the routers DHCP IP address maybe conflicting with the ISP modems IP address of 192.168.0.1. Check to see if this is the same on the ISP modem, and if modem can't be bridged, change the DIR router to 192.168.1.1 or .0.254.
  Example of a D-Link router configured for PPPoE with ISP Modem bridged: PPPoE Configuration on a Router

Also set the WAN port speed from Auto to 100Mb and test...

Immediately after installing this 1.20 / 2.20 HW B security fix (both files according to instructions) the 850L lost internet connection momentarily and again once every 5 minutes. It would reconnect then lose its connection exactly 5 minutes later and so on and so on. Any stream occurring would halt and would have to be restarted again manually from the app or streaming device. I am connected to a DSL modem via a 'DHCP dynamic ip' connection. Before the 1.20 / 2.20 security firmware the router worked perfectly. Careful screen shots were taken prior to the update to reconfigure.

I have since set up the router using the currently assigned IP address as a 'Static' address. Doing this has completely solved the "5 minute disconnect" thing. This is all well and good except when my ISP provider changes my dynamic IP address (which happens irregularly about 2wice a month) the router will lose its connection and the newly  assigned address will have to be reconfigured as a static address in the 850L router again.

Has any one else experienced this? Is this some thing D-link is aware of?

[lescarlson]

---"Was a factory Reset preformed..."
Yes. A reset prior to update and then a reset again after both files installed.
The 850L was re-configured by the screenshots taken before update (when the router was 100%). The router's 'Configuration Save and Load' feature was not used. It was reconfigured manually page by page.

---"What is the Mfr..."
Modem / Router is Netgear 7550 set up for use with Frontier ISP. It is and was configured in DMZ mode pointing to the 850L IP address.

---"ensure that 'Always ON' option is enabled"
There is NO setting for "Always ON" when the 850L's internet connection is set to "Dynamic IP (DHCP)". The DSL/PPPoE settings are made in the Netgear modem. The "Always ON" is selected in the Netgear Modem's 'Broadband Connection' page.

---"If the ISP modem has a built in router..."
The 850L router connects to the Netgear modem/router as it did before the 1.20/2.20 update. The Netgear modem/router was and is in DMZ mode using the 850L address. It is not in 'Bridge' mode. Before the 1.20/2.20 update the Netgear modem/router was in DMZ mode. The 850L was 100% before the update.

---"Also check the routers DHCP IP address maybe conflicting"
The 850L IP address is 192.168.0.1. The Netgear modem address is 192.168.254.254. These are LAN addresses. Do you mean something different when you suggest "DHCP IP address maybe conflicting"?

Thank you very much for your help.
Les

Was a factory reset performed after the last file was process then set up from scratch and don't load a saved configuration from file?

What is the Mfr and model of the ISP modem?

• For DSL/PPPoE connections on the router, ensure that "Always ON" option is enabled.
• If the ISP modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT and How NAT Works. Call the ISP and ask to see if the ISP modem can be bridged. To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ. Also check the routers DHCP IP address maybe conflicting with the ISP modems IP address of 192.168.0.1. Check to see if this is the same on the ISP modem, and if modem can't be bridged, change the DIR router to 192.168.1.1 or .0.254.
  Example of a D-Link router configured for PPPoE with ISP Modem bridged: PPPoE Configuration on a Router

Also set the WAN port speed from Auto to 100Mb and test...

[FurryNutz]

Ok, just checking to be sure of your ISP modem settings.

Can you test a quick test with the WAN port speed set to 100Mb from Auto? They try 1000Mb.

I presume that if the 850 has been working till v1.20 appeared, there maybe some issues in this FW version. I'll have D-Link review this.

I recommend you go back to last working version of FW and wait for results. I know that D-Link is working on the WPA2 security issue at hand now and the 850L is effected so let see if we can get them to look at this issue as well before they post the security patch for WPA2. 

[Gattsu]

lescarlson,

It looks like you have two routers in double NAT setup? Which router is receiving a public IP from ISP? Please verify with a network topology?

[FurryNutz]

The NG 7550 is a model and router combo. It's been running double NAT. The 850L is in the DMZ on the NG modem. Which has been working and should work ok. Has been working until he applied the v1.20 FW update. The 850L should only receive a private IP address while in the DMZ on the modem unless they can pass thru the public which I presume they are not.

[Gattsu]

So is the DMZ network reserving an IP for 850's WAN interface? Double check the MAC address on the WAN, make sure it matches the DHCP reservation bind.

[lescarlson]

---"Can you test a quick test with the WAN port speed set to 100Mb from Auto?"
Neither WAN port speed makes any difference.
Since my earlier post the WAN IP address has changed when the Netgear modem was rebooted. The 850L will not receive any internet when it is set to  "Dynamic IP (DHCP)" since the Netgear modem WAN IP address change. A "Static" connection with the new IP address plugged in will allow the 850L to connect to the internet again. My last working 850L firmware was 2.07 which is no longer available on the Dlink site. But there is a 2.09 firmware. I will try 2.09 until another update is released.

---"Double check the MAC address on the WAN, make sure it matches the DHCP reservation bind."
Is the "MAC address on the WAN" the same as the MAC address of the Netgear modem?
Also where would I locate the "DHCP reservation bind."?

Ok, just checking to be sure of your ISP modem settings.

Can you test a quick test with the WAN port speed set to 100Mb from Auto? They try 1000Mb.

I presume that if the 850 has been working till v1.20 appeared, there maybe some issues in this FW version. I'll have D-Link review this.

I recommend you go back to last working version of FW and wait for results. I know that D-Link is working on the WPA2 security issue at hand now and the 850L is effected so let see if we can get them to look at this issue as well before they post the security patch for WPA2. 

[Gattsu]

On the 850L, is the WAN port receiving a private or public IP for internet?

So if the IP is not within these range then its is a public IP.
192.168.0.0 - 192.168.255.255 (65,536 IP addresses)
172.16.0.0 - 172.31.255.255 (1,048,576 IP addresses)
10.0.0.0 - 10.255.255.255 (16,777,216 IP addresses)

---"Can you test a quick test with the WAN port speed set to 100Mb from Auto?"
Neither WAN port speed makes any difference.
Since my earlier post the WAN IP address has changed when the Netgear modem was rebooted. The 850L will not receive any internet when it is set to  "Dynamic IP (DHCP)" since the Netgear modem WAN IP address change. A "Static" connection with the new IP address plugged in will allow the 850L to connect to the internet again. My last working 850L firmware was 2.07 which is no longer available on the Dlink site. But there is a 2.09 firmware. I will try 2.09 until another update is released.

---"Double check the MAC address on the WAN, make sure it matches the DHCP reservation bind."
Is the "MAC address on the WAN" the same as the MAC address of the Netgear modem?
Also where would I locate the "DHCP reservation bind."?

Ok, just checking to be sure of your ISP modem settings.

Can you test a quick test with the WAN port speed set to 100Mb from Auto? They try 1000Mb.

I presume that if the 850 has been working till v1.20 appeared, there maybe some issues in this FW version. I'll have D-Link review this.

I recommend you go back to last working version of FW and wait for results. I know that D-Link is working on the WPA2 security issue at hand now and the 850L is effected so let see if we can get them to look at this issue as well before they post the security patch for WPA2. 

[FurryNutz]

Yes I do know that those are public IP addresses. Normally routers have a public ##.##.###.### however on occasion in a double NAT condition, one can put a router behind another router using the main routers DMZ which virtually passes all traffic however on most occasions, I only see the WAN port of the 2nd router getting a private IP address. All services work in this capacity though in this configuration.

Yes, I recommend a single NAT configuration when possible. In this case it has been working until this version of FW was applied...

[Gattsu]

lescarlson, mentioned that it works when he applies a static IP, instead of DHCP, but which router was this applied to?

I have since set up the router using the currently assigned IP address as a 'Static' address. Doing this has completely solved the "5 minute disconnect" thing. This is all well and good except when my ISP provider changes my dynamic IP address (which happens irregularly about 2wice a month) the router will lose its connection and the newly  assigned address will have to be reconfigured as a static address in the 850L router again.

It is true that ISP will change the Public IP on your router, whenever they want but only on the modem Netgear and this should not affect the 850L at all. If you say that modem is acting as a router and not bridged, then the 850L should be receiving a private IP address of 192.168.254.0/24 range. So the 850L should be receiving a DHCP IP from Netgear not ISP.

On the Netgear, check for DHCP reservation list and create one for the 850L.

[FurryNutz]

He'll have to confirm.

I know for when I'm testing in a double NAT condition, I can set a reservation on the 1st router and leave the 2nd router as DHCP and all works...However I don't have this particular model router nor the ISP modem.

Setting up a reservation on the 1st router would be good...