Overview

On September 9, 2020, a 3rd party security researcher reported the D-Link DIR-878 hardware revision Ax with firmware version v1.30B08 as having an authenticated command injection vulnerabilities.  

As soon as D-Link was made aware of the reported security issues, we had promptly started our investigation and began developing security patches.

D-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures.

Report information  

         - Discovered by CFF of Topsec Alpha Team

          Authenticated LAN-side vulnerability in /bin/prog.cgi when handle VirtualServer.html by posting the SOAPACTION: "http://purenetworks.com/HNAP1/SetVirtualServerSettings" data to the prog.cgi.

Important Requirements to Apply Patched firmware:

             In order to mitigate issue with Fixed firmware patch it requires a two-step manual update. Please follow these steps.

             1) Download 22-0412-DIR-878-v130B08_Beta.zip from the link below and decompress the ZIP file which will result in a folder of the same name.

             2) Log into the DIR-878 Web Configuration Interface.

             3) Click on Management on the Top Menu.-> Click on Upgrade on the Management Menu.

             4) Click Select File under Upgrade Firmware Manually.

             5) Select DIR-878 midware.img from the decompressed ZIP file folder and upgrade.

             6) Once updated the device will reboot,  you may need to re-connect to it's wireless network.

             7) Repeat steps 2, 3, and 4 hoever this time select DIR-878_A1_FW130B08_Beta.img and update the device a 2nd time

             8) Once update is complete, you should factory reset the unit and enter your unique settings.

Affected Models