| 제목 | D-Link DIR-850L Rev.A Wi-Fi router FW1.20WWb03 Hard-coded Credentials |
|---|
| 설명 | The D-Link DIR-850L Rev.A firmware runs a console login gate at every boot. The default init chain is /etc/init.d/rcS -> /etc/init0.d/rcS -> for i in /etc/init0.d/S??* ; do ... done, and it includes /etc/init0.d/S95password.sh:
#!/bin/sh
consolepwd
exit 0
/usr/sbin/consolepwd (also /sbin/consolepwd) prompts on the serial console with "Please login", "Login:" and "Password:", and compares the entered values against two constants compiled into the ELF image:
username: ws3cd
password: new_home!secu6-aar
The strings are present in .rodata at offsets 0x2abc ("ws3cd") and 0x2a68 ("new_home!secu6-aar"); the comparisons are visible in the disassembly at 0x4015b4 (username) and 0x4010c4 (password), with a successful comparison returning 0 at 0x401644. The credential is fixed in the binary and is not changed when the Web administrator password is changed.
Verified and confirmed: ws3cd / new_home!secu6-aar is accepted (consolepwd returns 0 and the boot continues), while an unknown user or a wrong password returns to the "Login:" prompt.
This is CWE-798 (Use of Hard-coded Credentials) and CWE-1188 (Insecure Default Initialization of Resource). It is a local serial-console authentication issue, not a network service.
CVSS 3.1: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
|
|---|
| 사용자 | BenSmith (UID 102206) |
|---|
| 제출 | 2026. 10. 20. AM 07:24 (26 날 ago) |
|---|
| 모더레이션 | 2026. 11. 14. PM 05:58 (25 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 437458 [D-Link DIR-850L FW1.20WWb03 Console Login /usr/sbin/consolepwd 약한 인증] |
|---|
| 포인트들 | 20 |
|---|