A back door has been found in the firmware for a number of later-model D-Link router models, allowing an intruder to bypass user authentication. The backdoor was first found by Craig Heffner, a vulnerability researcher with Tactical Network Solutions, who was tinkering with the 1.13 version of the firmware for the D-Link DIR-100 revA router.
According to a blog post by Heffner, the backdoor is trivially-easy to access.
"If your browser’s user agent string is 'xmlset_roodkcableoj28840ybtide' (no quotes), you can access the web interface without any authentication and view/change the device settings," notes Heffner.
Impacted models include the DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+, TM-G5240 and potentially the DIR-615 (distributed by Virgin Mobile). Planex Communications BRL-04UR and BRL-04CW routers may also be impacted, as they utilize the same firmware.
