FYI...D-Link DIR-300 / 600 routers vuln
Feb 7, 2013 - "... vulnerabilities in D-Link’s DIR-300 and DIR-600 routers could allow an attacker to inject arbitrary shell commands and ultimately compromise the device... Messner first discovered the vulnerabilities at the tail end of 2012 and forwarded them to D-Link who insisted the issue was relegated to browsers and that the company would not publish a fix
. Messner elected to provide more information to D-Link more than a week and a half ago, on January 25. Having still not heard back yet, Messner saw fit to publicly releasing the attack details earlier this week. A post by The H-Security* claims that all current D-Link firmware versions (Version 2.13, released November 7, 2012 and Version 2.14b01, released January 22, 2013) are affected by the flaw and suggests – at least until D-Link issues a fix – to “decommission the affected browsers.” D-Link did not respond to e-mail requests for comment..."
6 Feb 2013
Feb 07, 2013
Analysis: "Many home offices and small offices use broadband connections with devices like the D-Link routers. Such environments don't often have security savvy people on staff, and the compromise of such devices can lead to all sorts of issues such as attackers planting malicious DNS servers in the device configuration that affect every system on the LAN using DHCP to receive DNS settings. In addition, an attacker could use such a vulnerability to penetrate deeper into an enterprise network by compromising a machine on the LAN and backdooring it."
8 Feb 2013
Release Date: 2013-02-08
Criticality level: Moderately critical
Impact: Exposure of system information, System access
Where: From local network
... weakness, security issues, and vulnerability are reported in the following products:
* D-Link DIR-300 version 2.12 and 2.13.
* D-Link DIR-600 version 2.12b02, 2.13b01, and 2.14b01.
Solution: No official solution is currently available.