{"id":2819,"date":"2021-07-19T14:06:35","date_gmt":"2021-07-19T19:06:35","guid":{"rendered":"https:\/\/cert.pa\/?p=2819"},"modified":"2021-07-19T14:06:35","modified_gmt":"2021-07-19T19:06:35","slug":"csirt-panama-aviso-2021-07-16-multiples-vulnerabilidades-en-router-d-link-dir-3040","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=2819","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2021-07-16: M\u00faltiples vulnerabilidades en router D-LINK DIR-3040"},"content":{"rendered":"\n

Gravedad: Alta
Fecha de publicaci\u00f3n: Julio 19, 2021
\u00daltima revisi\u00f3n: Julio 19, 2021
Sitio web: https:\/\/support.dlink.com<\/a>
Sistemas afectados: D-LINK DIR-3040, versi\u00f3n 1.13B03 y anteriores.<\/p>\n\n\n\n

I. Descripci\u00f3n<\/strong>
Cisco Talos, Dave McDaniel, ha notificado 5 vulnerabilidades, 2 de severidad cr\u00edtica, 2 altas y 1 media, que podr\u00edan permitir a un atacante la exposici\u00f3n de informaci\u00f3n sensible, causando una denegaci\u00f3n de servicio y obteniendo la capacidad de ejecutar c\u00f3digo arbitrario.<\/p>\n\n\n\n

II. Impacto<\/strong>
Vulnerabilidad: CVE-2021-21819<\/p>\n\n\n\n

Un atacante podr\u00eda enviar una secuencia de peticiones, especialmente dise\u00f1adas, para explotar una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo en la funcionalidad Libcli Test Environment, lo que podr\u00eda resultar en una ejecuci\u00f3n de comandos arbitrarios.<\/p>\n\n\n\n

Vulnerabilidad: CVE-2021-21820<\/p>\n\n\n\n

Un atacante podr\u00eda enviar una secuencia de peticiones, especialmente dise\u00f1adas, para explotar una vulnerabilidad de credenciales en texto claro en la funcionalidad de Libcli Test Environment, lo que podr\u00eda resultar en una ejecuci\u00f3n de c\u00f3digo.
Para el resto de vulnerabilidades se han asignado los identificadores: CVE-2021-21816, CVE-2021-21817 y CVE-2021-21818.<\/p>\n\n\n\n

III. Referencia a soluciones, herramientas e informaci\u00f3n<\/strong><\/p>\n\n\n\n

Instalar las actualizaciones seg\u00fan indique el fabricante, mediante el siguiente enlace: https:\/\/support.dlink.com\/resource\/SECURITY_ADVISEMENTS\/DIR-3040\/REVA\/DIR-3040_REVA_FIRMWARE_v1.13B03_HOTFIX.zip<\/a><\/p>\n\n\n\n

Fuentes:<\/strong><\/p>\n\n\n\n

  1. Instituto Nacional de Ciberseguridad, INCIBE. Avisos Seguridad, M\u00faltiples vulnerabilidades en router D-LINK DIR-3040. 16 de julio del 2021. Recopilado en: https:\/\/www.incibe-cert.es\/alerta-temprana\/avisos-seguridad\/multiples-vulnerabilidades-router-d-link-dir-3040<\/a><\/li>
  2. Cisco Talos. Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040. Recopilado en: https:\/\/blog.talosintelligence.com\/2021\/07\/vuln-spotlight-d-link.html<\/a><\/li><\/ol>\n\n\n\n

    Informaci\u00f3n de contacto<\/strong><\/p>\n\n\n\n

    CSIRT PANAMA
    Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
    E-Mail: info@cert.pa
    Phone: +507 520-CERT (2378)
    Web: https:\/\/cert.pa
    Twitter: @CSIRTPanama
    Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"

    Gravedad: AltaFecha de publicaci\u00f3n: Julio 19, 2021\u00daltima revisi\u00f3n: Julio 19, 2021Sitio web: https:\/\/support.dlink.comSistemas afectados: D-LINK DIR-3040, versi\u00f3n 1.13B03 y anteriores. I. Descripci\u00f3nCisco Talos, Dave McDaniel, ha notificado 5 vulnerabilidades, 2 de severidad cr\u00edtica, 2 altas…<\/p>\n","protected":false},"author":4,"featured_media":2820,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-2819","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2819","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2819"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2819\/revisions"}],"predecessor-version":[{"id":2821,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2819\/revisions\/2821"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/2820"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2819"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2819"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2819"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}