| Titolo | D-Link DIR-850L Rev.A Wi-Fi router FW1.20WWb03 Hard-coded Credentials |
|---|
| Descrizione | The D-Link DIR-850L Rev.A firmware runs a console login gate at every boot. The default init chain is /etc/init.d/rcS -> /etc/init0.d/rcS -> for i in /etc/init0.d/S??* ; do ... done, and it includes /etc/init0.d/S95password.sh:
#!/bin/sh
consolepwd
exit 0
/usr/sbin/consolepwd (also /sbin/consolepwd) prompts on the serial console with "Please login", "Login:" and "Password:", and compares the entered values against two constants compiled into the ELF image:
username: ws3cd
password: new_home!secu6-aar
The strings are present in .rodata at offsets 0x2abc ("ws3cd") and 0x2a68 ("new_home!secu6-aar"); the comparisons are visible in the disassembly at 0x4015b4 (username) and 0x4010c4 (password), with a successful comparison returning 0 at 0x401644. The credential is fixed in the binary and is not changed when the Web administrator password is changed.
Verified and confirmed: ws3cd / new_home!secu6-aar is accepted (consolepwd returns 0 and the boot continues), while an unknown user or a wrong password returns to the "Login:" prompt.
This is CWE-798 (Use of Hard-coded Credentials) and CWE-1188 (Insecure Default Initialization of Resource). It is a local serial-console authentication issue, not a network service.
CVSS 3.1: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
|
|---|
| Utente | BenSmith (UID 102206) |
|---|
| Sottomissione | 20/10/2026 07:24 (26 giorni fa) |
|---|
| Moderazione | 14/11/2026 17:58 (25 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 437458 [D-Link DIR-850L FW1.20WWb03 Console Login /usr/sbin/consolepwd autenticazione debole] |
|---|
| Punti | 20 |
|---|