D-Link has plugged a security vulnerability involving protocol handling by some of its wireless routers that creates a potential means for normal users to grab super-user privileges.

The network manufacturer issued a firmware update that addresses a recently discovered bug in how its networking devices handle the Home Network Administration Protocol (HNAP). The flaw meant that the devices offered a shadow connection outside of the regular administrative access channel. This permanent unauthorised connection might be exploited by miscreants to assume admin privileges and change router settings, and might also be used to bypass CAPTCHA login features introduced by D-Link in recent firmware upgrades.

Successful exploitation requires valid login credentials, so the flaw is a privilege elevation risk rather than something more serious. The security shortcoming was found by SourceSec (advisory here (pdf)) and covered by D-Link with an advisory on Monday.

Only some of D-Link's routers are vulnerable. The networking manufacturer issued updates for its DIR-635, DIR-655 and DIR-855 routers.

Discontinued DIR-615, DI-634M and DIR-635 models are also at risk. An update for the DIR-615 is already available, with updates for the DI-653-M and DIR-635 is promised for upcoming weeks.

An (German language) advisory from D-Link explaining the issue in greater detail - along with a list of affected and not-at-risk models and links to firmware patches - can be found here. ®

Related stories

• Cisco patches enterprise wireless vulns (6 March 2014)

  https://www.theregister.com/2014/03/06/cisco_patches_enterprise_wireless_vulns/

• Team Cymru spots 300,000 compromised SOHO gateways (4 March 2014)

  https://www.theregister.com/2014/03/04/team_cymru_ids_300000_compromised_soho_gateways/

• Malware-flinging Linksys vulnerability confirmed as a HNAP1 bug (17 February 2014)

  https://www.theregister.com/2014/02/17/linksys_vuln_confirmed_as_a_hnap1_bug/

• Security cameras leak credentials, live video (1 May 2013)

  https://www.theregister.com/2013/05/01/ip_cameras_with_dumb_vulns/

• D-Link: Vendors can do more to support channels (21 February 2011)

  https://www.theregister.com/2011/02/21/d_link_and_au_channel/

• Flaw could expose 'millions' of home routers (19 July 2010)

  https://www.theregister.com/2010/07/19/home_router_hack/

• Hacker pierces hardware firewalls with web page (6 January 2010)

  https://www.theregister.com/2010/01/06/web_based_firewall_attack/

• Hacker pilfers browser GPS location via router attack (5 January 2010)

  https://www.theregister.com/2010/01/05/geo_location_stealing_hack/

• Belkin preps Wi-Fi gadget-sharer (16 September 2009)

  https://www.theregister.com/2009/09/16/belkin_intros_printer_sharer/

• D-Link DHP-303 (8 September 2009)

  https://www.theregister.com/2009/09/08/review_networking_powerline_d_link_dhp_303/

• Buggy home routers expose O2 customers to hijacking (1 September 2009)

  https://www.theregister.com/2009/09/01/buggy_o2_routers/

• D-Link Xtreme N DIR-685 (28 July 2009)

  https://www.theregister.com/2009/07/28/review_storage_network_dlink_extreme_dir_685/

• Open-source firmware vuln exposes wireless routers (21 July 2009)

  https://www.theregister.com/2009/07/21/critical_ddwrt_router_vuln/