THANK YOU FOR SUBSCRIBING
Enterprise Security Magazine | Wednesday, December 16, 2020
Cybersecurity firm Digital Defense’s research team found a vulnerability impacting several D-Link VPN routers.
FREMONT, CA: Digital Defense, a pioneer in vulnerability management and threat assessment solutions, announces that its Vulnerability Research Team (VRT) disclosed a previously undetected vulnerability impacting D-Link VPN routers. D-Link DSR-150, DSR-250, DSR-500 and DSR-1000AC VPN routers running firmware version 3.14 and 3.17 are prone to a remotely exploitable root command injection flaw.
These devices are usually available on consumer websites/eCommerce sites like Amazon, Best Buy, Office Depot and Walmart. Given the increase in work-from-home due to the pandemic, more employees may be connecting to corporate networks using one of the impacted devices.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
The vulnerable factor of these devices is accessible with no authentication. From WAN and LAN interfaces, this vulnerability could be used over the Internet. A remote, unauthenticated attacker who has access to the routers web interface could execute arbitrary commands as root, gaining complete control of the router. With this access, an attacker could modify traffic, cause a denial of service and launch further threats on other assets. D-Link routers can connect up to 15 devices simultaneously.
The standard practice is to work with organizations on a coordinated disclosure initiative to facilitate a prompt resolution to a vulnerability. The Digital Defense VRT reached out to D-Link who worked diligently on a patch. The company will outreach to customers ensuring they are aware and can take action to mitigate any potential risk introduced by the vulnerability.
D-Link is a pioneer in designing and developing networking and connectivity products for consumers, small businesses, medium to large-sized companies and service providers. The company has grown into an award-winning global brand. D-Links line of VPN routers enables remote workers to connect securely to company resources.
The Digital Defense VRT reg works with organizations promoting the responsible disclosure of zero-day vulnerabilities. The expertise of the VRT, when coupled with the company’s next-generation hybrid cloud platform, Frontline Vulnerability Manager, allows early detection capabilities.
More in News