ZDI-22-1503: D-Link DIR-1935 HNAP Incorrect Comparison Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from an incorrectly implemented comparison. An attacker can leverage this vulnerability to bypass authentication on the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-22-1503?
The severity of ZDI-22-1503 is high due to the potential for network-adjacent attackers to bypass authentication without any required credentials.
How do I fix ZDI-22-1503?
To fix ZDI-22-1503, update the D-Link DIR-1935 router firmware to the latest version provided by D-Link.
What type of attacks can occur due to ZDI-22-1503?
ZDI-22-1503 can allow attackers to gain unauthorized access to the router's administrative interface and manipulate its configuration.
Who is affected by ZDI-22-1503?
The vulnerability ZDI-22-1503 affects installations of D-Link DIR-1935 routers that have not yet been updated to address the issue.
Is authentication required to exploit ZDI-22-1503?
No, authentication is not required to exploit the vulnerability ZDI-22-1503, making it particularly dangerous.