On November 20, 2018, it was disclosed that D-Link's Central WiFi Manager Windows O/S Software Application (described here), was disclosed to have multiple security vulnerabilities. The vulnerabilities were found in the Central WiFiManager Software Controller, allows unauthenticated arbitrary SQL command execution, SQL injecion, and XSS vulnerabilities.
D-Link® Central WiF iManager software controller helps network administrators streamline their wireless access point (AP) management workflow. Central WiFi Manager is an innovative approach to the more traditional hardware-based multiple access point management system. It uses a centralized server to both remotely manage and monitor wireless APs on a network. Whether deployed on a local computer or hosted on a public cloud service, Central WiFi Manager can be easily integrated into existing networks in conjunction with supporting D-Link wireless APs, to help eliminate existing bottlenecks for wireless traffic.
3rd Party Report Accreditation:
Discovered and researched by M3@ZionLab from DBAppSecurity.
Affected Products:
This disclosure directly affects the software package and current installations should be update with the new released available to download below. Failure to update may put this software package, the host computer it runs on, and D-Link devices that it manages at risk.
Solution/Patch/Fix:
- Arbitrary SQL query
- Remote command execution
- SQL injection
- Cross site scripting
Security Patches
These updates address the security vulnerabilities in affected D-Link software package. D-Link will update this continually and we strongly recommend all users to install the relevant updates.
To update we reccomend saving your configuration, uninstall the old package, then install the new update. Further assistance can be found via chat or email at http://support.dlink.com