| 제목 | D-Link DCS-930L Network Camera B1.08B4 / firmware 1.08 Improper Verification of Cryptographic Signature |
|---|
| 설명 | A vulnerability was found in D-Link DCS-930L Network Camera firmware B1.08B4 / firmware 1.08. The affected component is the bootloader "Emergency Room" HTTP recovery server in bootloader_region.bin.
When the reset button is held during power-on, the bootloader enters Emergency Room recovery mode and starts an HTTP server on TCP port 80. The server accepts multipart/form-data POST requests containing a part named firmware, decoded by mpfd_decode at 0x8001A03C.
The recovery request is handled by a monolithic function from 0x800193B4 to 0x80019B98. Inside this function, the validator at 0x80019448 to 0x80019700 is directly connected to the flash writer at 0x80019768 to 0x80019B64. The branch at 0x80019684 transfers from the validation logic to the flash-writing logic without any authentication or privilege check.
The validator only performs format checks. It verifies the uImage magic value 0x27051956 using the instructions at 0x800194C4 to 0x800194CC, then checks header-field consistency, declared data size, and the image type IH_TYPE_KERNEL. No RSA, HMAC, SHA, or MD5 verification routine is referenced in the validator, and no authentication logic exists in the analyzed bootloader region.
As a result, any file with a well-formed uImage header can pass validation regardless of payload authenticity. Once validation succeeds, the writer erases and programs the kernel partition at flash offset 0x50000 using the flash controller register 0xB000620. The bootloader logs messages such as "Erase linux block" and "Copy to Flash", and the written image is loaded on the next boot.
Successful exploitation requires physical access to place the device into Emergency Room mode by holding the reset button during power-on. An attacker on the recovery network can then upload a crafted uImage and overwrite the kernel partition without authentication or cryptographic signature verification.
Affected functions and code regions include:
Emergency Room HTTP recovery handler: 0x800193B4-0x80019B98
image validator: 0x80019448-0x80019700
uImage magic comparison: 0x800194C4-0x800194CC
image-type branch into flash writer: 0x80019684
flash writer: 0x80019768-0x80019B64
flash controller operations: 0x80019AFC-0x80019B48
mpfd_decode: 0x8001A03C
HttpHandler / do_httpsvr: 0x8001A030 / 0x8001A120 |
|---|
| 원천 | ⚠️ https://github.com/sweethub521/somevul/blob/main/dlink-dcs930l-bootloader-emergency-room-flash.md |
|---|
| 사용자 | sleep (UID 100148) |
|---|
| 제출 | 2026. 09. 25. AM 10:32 (17 날 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 09:47 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416789 [D-Link DCS-930L B1.08B4 Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode firmware 약한 인증] |
|---|
| 포인트들 | 20 |
|---|