D-Link "fixed" serious security issues - by adding a fourth serious vulnerability

[OpenSourcerer 1442]

/dev/ttyS0 recently analyzed D-Link's DIR-890L and found a security issue which opens up the possibility of executing any code with privileges of system, i.e. root.

The worst thing about it is: The firmware version was designed to patch three different vulnerabilities in connection with HTTP and UPnP...

 

.. which were, well, not really closed.

• If you are using a D-Link router or
• if you are planning on buying one,

scroll to the bottom of the post and see if your model is listed there. If so, you should really think about your habits or your choices, respectively.

 

From what I understood, this can only be exploited in a local network. The truth is: If D-Link doesn't seem to care about exploits in local networks - do you really think they care about what's coming from the internet? You should really abandon the D-Link ship.