• October 14, 2019, 02:20:58 AM
  • Welcome, Guest
Please login or register.

Login with username, password and session length
Advanced search  

News:

This Forum Beta is ONLY for registered owners of D-Link products in the USA for which we have created boards at this time.

Author Topic: DIR-655 - Rev C - Multiple Vulnerabilities  (Read 1149 times)

GreenBay42

  • Administrator
  • Level 10 Member
  • *
  • Posts: 2189
DIR-655 - Rev C - Multiple Vulnerabilities
« on: January 17, 2019, 07:14:14 AM »

We have uncovered several critical flaws in the D-Link DIR-655 consumer grade router. In conjunction these issues allow an attacker to remotely take control of a user's device if they visit a malicious webpage.

The issues are as follows:
● Command injection via device configuration setting
● Setup wizard can be used to reset password to default
● Cross-site request forgery
● Multiple reflected cross-site scripting issues

Joel St. John
Security Consultant
NCC Group

Fixed Firmware (Revision Cx Only) - ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_FIRMWARE_v3.02B05_BETA03.zip
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 47834
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DIR-655 - Rev C - Multiple Vulnerabilities
« Reply #1 on: January 17, 2019, 07:34:28 AM »

Wow, I get to drag out my Rev C.  :o
Logged
Cable:200mb/10Mb>NetGear C7800>DIR-882>DGS-1100>HP 24pt Gb Switch. COVR-3902/2202/1203,DIR-2680,890L,882,880L,868L,DNR-202L,DNS-345x2,DCS-933L,936L and 960L.
Go Here>Router Troubleshooting

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 47834
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DIR-655 - Rev C - Multiple Vulnerabilities
« Reply #2 on: September 25, 2019, 06:29:31 AM »

8 months later, my Rev C went online last night.  ;D No issues seen thus far. Speeds are great. TS and QoS enabled. Feel odd working in the old UI.  :P Memories.  8) Will try and get some gaming in.  ;D
Logged
Cable:200mb/10Mb>NetGear C7800>DIR-882>DGS-1100>HP 24pt Gb Switch. COVR-3902/2202/1203,DIR-2680,890L,882,880L,868L,DNR-202L,DNS-345x2,DCS-933L,936L and 960L.
Go Here>Router Troubleshooting

GreenBay42

  • Administrator
  • Level 10 Member
  • *
  • Posts: 2189
Re: DIR-655 - Rev C - Multiple Vulnerabilities
« Reply #3 on: September 25, 2019, 12:49:00 PM »

Solid router :)
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 47834
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DIR-655 - Rev C - Multiple Vulnerabilities
« Reply #4 on: September 25, 2019, 12:51:00 PM »

Was a work horse for many years.  ;) Works nicely with a WiFi AX upgrade.  :o
Logged
Cable:200mb/10Mb>NetGear C7800>DIR-882>DGS-1100>HP 24pt Gb Switch. COVR-3902/2202/1203,DIR-2680,890L,882,880L,868L,DNR-202L,DNS-345x2,DCS-933L,936L and 960L.
Go Here>Router Troubleshooting

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 47834
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DIR-655 - Rev C - Multiple Vulnerabilities
« Reply #5 on: September 30, 2019, 11:29:17 AM »

One issue i'm seeing with this build of FW, When I attempt to input a valid IP address or select an IP address from the Firewall/DMZ's List of detected devices, after enabling the check box and selecting Save Settings, Safari, Opera or FireFox displays:
"413 - Request Entity Too Large"

I'm trying to set a WiFi AP into the DMZ temporarily.

Seen this before in a earlier version of the Rev C FW versions years ago. I think when I was doing IP address reservations. I hoped this was gone...

Thoughts?
Logged
Cable:200mb/10Mb>NetGear C7800>DIR-882>DGS-1100>HP 24pt Gb Switch. COVR-3902/2202/1203,DIR-2680,890L,882,880L,868L,DNR-202L,DNS-345x2,DCS-933L,936L and 960L.
Go Here>Router Troubleshooting