Overview

On October 29, 2021, D-Link became aware of a number of potential MediaTek WiFi vulnerabilities involving Wi-Fi WPS/IEEE-1905 called BadMesher & Authentication Flooding.

As soon as D-Link was made aware of the reported security issues, we had promptly started our investigation and began developing security patches.

D-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures.

Report information  

            - BadMesher: New Attack Surfaces of Wi-Fi Mesh Network. A Black Hat Briefing publicly disclose the technical details on some of the Wi-Fi Mesh vulnerabilities in MediaTek Wi-Fi chipsets that could allow a proximate attacker (within Wi-Fi range of both the client device and the access point) to inject malicious packets containing illegal WPS IE and might cause device reboot, denial of service or possible escalation of privilege.

                 - MediaTek Information: Link

                 - Black Hat BadMesher Briefing: Link

                   - CVE-2021-32467 : Out-of-bounds Read

                   - CVE-2021-32468 : Out-of-bounds Read

                   - CVE-2021-32469 : Out-of-bounds Read

                   - CVE-2021-35055 : Out-of-bounds Write

                   - CVE-2021-37560 : Out-of-bounds Write

                   - CVE-2021-37561 : Out-of-bounds Write

                   - CVE-2021-37562 : Out-of-bounds Read

                   - CVE-2021-37563 : Out-of-bounds Write

                   - CVE-2021-37584 : Out-of-bounds Write 

            - Wi-Fi Authentication Flooding Vulnerabilities
 

                 - MediaTek Information: Link 

                    - CVE-2021-41788 : Mishandle attempts at Wi-Fi authentication flooding

Affected Models