Details: The 'cgi-bin/webproc' directory within the user account, there is an unrestricted stored Cross-Site Scripting (XSS) vulnerability and injection attacks on the 'SSID' parameter of the "D-Link DIR-816" system. This function executes the user parameter without restrictions. To view the script in action, simply access the 'Setup' directory. Malicious attackers can exploit this vulnerability to obtain sensitive information from clients.
Affected Models
Recommendation for EOL /EOS Products
In line with industry practice, D-Link may periodically determine that certain products have reached a stage where further support or development is no longer attainable. This decision may be driven by commonly acknowledged factors such as technology evolution, market requirement, innovation, product efficiency, or the need for product replacement due to superior functionality.
For US Consumers
When a product reaches EOL/EOS status, which we have always announced for an extended period in advance, no further extended support, updates, or development may be available.
We may not be able to address issues related to devices or firmware for such products, as development and customer support may have been discontinued. If you are outside the US, please get in touch with your regional D-Link office for an inquiry.
We recommend discontinuing such products and caution that continued use may harm other connected devices. If users continue using these devices, please ensure they are updated to the latest known firmware on the Legacy Website links above. Additionally, users should frequently update a device's unique password to access its web configuration and always have Wi-Fi encryption enabled with a strong and unique password.
Regarding the Security Update for Your Device
Installing firmware updates is critical in addressing security vulnerabilities in your devices. We strongly urge all users to install the relevant updates and regularly check for further updates. After downloading the firmware update, it is essential to ALWAYS validate its success by comparing the firmware version on your product interface to the firmware update version.
Please note that beta software, beta firmware, or hot-fix release is still undergoing rigorous testing before its official release. This ensures it is of the highest quality and meets our stringent standards. Due to such nature, we do not provide express or implied warranties regarding its suitability or usability. It is essential to understand that the user assumes all risk and liability for its use.
NOTE: Our products have different hardware revisions, so please check your device’s hardware revision before downloading the corresponding firmware update. The hardware revision can be found on the product label next to the serial number or on the device's web interface.