Secunia

Gregory Duchemin has reported a vulnerability in D-Link DI-614+ and DI-704, which can be exploited by malicious people to conduct script insertion attacks.

The vulnerability is caused due to missing input validation within the handling of DHCP requests. This can be exploited by inserting arbitrary HTML or script code in the DHCP "HOSTNAME" option, which will cause it to be logged unfiltered.

Successful exploitation executes the code in an administrative user's browser session when the malicious DHCP information is viewed in a report / log.

The vulnerability has been reported in DI-614+ firmware 2.30 and DI-704 firmware 2.60B2. Other versions may also be affected.

Solution
Disable the DHCP service.

Provided and/or discovered by
Gregory Duchemin

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area