d-link.di-701.txt

`D-Link DI-701 Residential Gateway's Admin login available on external port  
As part of our company's evaultion of security products for our use, I  
discovered a serious flaw in the D-Link DI-701 Residential Gateway. This  
box is touted as a personal firewall to protect home users (cable modems)  
from attacks. The box uses network address translation and blocks external  
attempts to get to the internal network. Unfortunatly, the administrative  
login on port 333 is available on the external and internal side of the  
firewall. Compounded this is the fact that your password (no username) can  
only be 6 characters long! A quick brute force against this password  
revealed a superadmin password that is set to "year200". What is especially  
troubling is that your internal IDS will not pick up the multiple attempts  
at either the 6 character normal password or the 7 character superadmin  
password.  
  
Brant Hale  
VC3, INC  
  
`