Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[FurryNutz]

NOTE: Firmware 1.30B06 (Official release, not hotfix) has the below security fixes included even though version number is lower).


Firmware: v1.30 B10 Beta   02/21/2020
Revision Info
Overview

On December 23, 2019, Trend Micro's Zero Day Initiative (ZDI) research team submitted two security-related issues (1) CVE-2020-8863 (ZDI ID: ZDI-CAN-9470) an HNAP PrivateLogin Incorrect Implementation of Authentication Algorithm Authentication Bypass vulnerability and (2) CVE-2020-8864 (ZDI ID: ZDI-CAN-9471) an HNAP strncmp Incorrect Comparison Authentication Bypass vulnerability. These vulnerabilities are  logic flaws in the implementation of the HNAP allowing an LAN-Side attacker to bypass authentication and reset the admin password

3rd Party Report information
          - Report provided chung96vn - Security Researcher of VinCSS (Member of Vingroup) working with Trend Micro ZDI

          - Reference :

            - CVE-2020-8863 :: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8863

               -  ZDI-CAN-9470: D-Link Routers HNAP PrivateLogin Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability

             - CVE-2020-8864 :: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8864

                - ZDI-CAN-9471: D-Link Multiple Routers HNAP strncmp Incorrect Comparison Authentication Bypass Vulnerability

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157

Get it here: NA Region
DIR-882-US

Please follow the> FW Update Process to ensure a good FW upgrade is performed.

Let us know how it works for you...

[PitbulI]

Tried to install, failed. No reason given.

Might try again this weekend but I don't want to brick the router and this seems to be a security fix, not functionality changes.

[FurryNutz]

I just manually downloaded and using IE11, installed fine on mine. v1.20 was prior version loaded. 
I didn't test the router out as I'm using something different currently.

Tried to install, failed. No reason given.

Might try again this weekend but I don't want to brick the router and this seems to be a security fix, not functionality changes.

[core]

Upgraded from 1.20 to 1.30 just fine:

Browser: Firefox 74.0
OS: Linux Mint 19.3
File: DIR-882_REVA_FIRMWARE_1.30B10_BETA.BIN

Thank you D-Link for the security patch.

[FurryNutz]

Thanks for letting us know.
Enjoy. 

[zme-ul]

is there a difference for EU? can I try the US BETA?

nevermind, I updated to 1.30 BETA, no issues so far - will report back if I discover something

[FurryNutz]

Thanks for letting us know.

Enjoy. 

[zme-ul]

reverted back to 1.20
I found that my Android phones have a tough time searching for system updates - back on 1.20 is working smooth

[FurryNutz]

Did you factory reset and setup from scratch after v1.30 was applied.

reverted back to 1.20
I found that my Android phones have a tough time searching for system updates - back on 1.20 is working smooth

[ashishchandra]

reverted back to 1.20
I found that my Android phones have a tough time searching for system updates - back on 1.20 is working smooth

Am facing the same issue.

[GreenBay42]

Make you both contact tech support to report the issue.

What version of android are you using?
Make/Model of phone/tablet?

[FurryNutz]

Yes Master Yoda. 

[zme-ul]

Make you both contact tech support to report the issue.

What version of android are you using?
Make/Model of phone/tablet?

Nokia 7.1 Andoid 10 latest (february ?!) patch
Nokia 3 Android 9 latest patch

[FurryNutz]

v1.30 is working for me.
NG CM1100 cable mode>DIR-882
DNS Relay Disabled.
Smart Connect enabled.

Samsung Galaxy Tab S2, Android v7.0
Google store just updated 27 apps thru the 882.

[zme-ul]

not talking about Google Store, I'm talking about System Updates for the Android OS