IS-2010-005 - D-Link DAP-1160 Authentication Bypass
Firmware version: 1.20b06
Successfully tested on D-Link DAP-1160 loaded with firmware versions:
v120b06, v130b10, v131b01.
Other models and/or firmware versions may be also affected.
Note: Only firmware version major numbers are displayed on the
administration web interface: 1.20, 1.30, 1.31
D-Link DAP-1160 is a wireless access points that allow wireless clients
connectivity to wired networks.
Supported 802.11b and 802.11g protocols. WEP, WPA and WPA2 supported.
Administration interface authentication can be bypassed by accessing a
specific URL shortly after device reboot
Accessing the device web administration interface requires a successful
authentication with proper login credentials.
But if the following URL address:
is accessed as a first URL and within a short time (~40 seconds) after
the device web server has started, then no authentication is required to
access device web interface.
The device can then be freely reconfigured and sensitive information can
be extracted and/or modified, such as Wi-Fi SSID and passphrases.
A remote attacker may be able to achieve deterministic authentication
bypass, without waiting for the device to be rebooted, by remotely
rebooting the device via the DCC protocol.
This can be performed in unauthenticated manner, as described in the
advisory "IS-2010-004 - D-Link DAP-1160 Unauthenticated Remote
Remote extraction of sensitive information
Modification of existing device configuration
Solutions & Workaround:
17/02/2010: Vulnerability discovered
17/02/2010: No suitable technical/security contact on Global/Regional
website. No contact available on OSVDB website
18/02/2010: Point of contact requested to customer service
----------- No response -----------
26/05/2010: Vulnerability disclosed at CONFidence 2010
29/06/2010: This advisory
Additional information available at http://www.icysilence.org