Hardcoded credentials

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the use...

Design/Logic Flaw

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and...

CVE-2017-8416

The CVE-2017-8416 issue affects D-Link DCS-1100 and DCS-1130 devices. A daemon listening on UDP port 5978 processes a custom discovery protocol; an unbounded copy (strcpy) within packet handling can overflow the stack, enabling remote code execution. An attacker on the local network can trigger t...

CVE-2017-8413

Summary: CVE-2017-8413 affects D-Link DCS-1100 and DCS-1130 network cameras. A custom UDP-based discovery daemon (port 5978, named dldps2121) processes broadcast packets. If a packet with type S (0x53) is received, the base64-encoded parameter C is decoded and passed to a system API, enabling com...

CVE-2017-8413

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and...

CVE-2017-8410

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTS...

CVE-2017-8409

An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed...

CVE-2017-8414

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f"...

CVE-2017-8406

An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In thi...

CVE-2017-8405

An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be...

Cross site scripting

An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In thi...

Memory corruption

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f"...

Design/Logic Flaw

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTS...

Default credentials

An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed...

CVE-2017-8415

Affected devices: D-Link DCS-1100 and DCS-1130. The vulnerability stems from a hardcoded credential mechanism used by a custom telnet daemon (part of BusyBox) where the password check uses a salted hash of the string "admin" stored in /etc/shadow on a CRAM-FS filesystem. Because the filesystem is...

CVE-2017-8415

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the use...

CVE-2017-8412

CVE-2017-8412 affects D-Link DCS-1100 and DCS-1130 devices. A custom mp4ts binary in /var/www/video dumps the HTTP VERB into logs and copies user input via a vulnerable sprintf into a string without bounds checking, leading to a stack overflow that can overwrite the PC and enable buffer overflow ...

CVE-2017-8414

CVE-2017-8414 affects D-Link DCS-1100 and DCS-1130 network cameras. The /sbin orthrus UPnP handler takes the command-line parameter -f and performs a sprintf to the stack without length checking, which corrupts registers in a function (sub_A098) and leads to memory corruption. Public advisories (...

CVE-2017-8410

The CVE-2017-8410 issue affects D-Link DCS-1100 and DCS-1130 cameras. The rtspd RTSP handler in /sbin performs a memcpy using the Authorization: Basic header data, with copy length derived from the header string length, causing a stack overwrite and memory corruption. This leads to potential arbi...

CVE-2017-8405

CVE-2017-8405 affects D-Link DCS-1130 and DCS-1100 cameras. The rtspd binary loads an Authenticate flag (default 0) that governs access to the video feed. While HTTP management requires login, RTSP does not enforce authentication by default, because the corresponding checkbox is unchecked. This c...