CVE-2019-12768
📋 TL;DR
This vulnerability allows attackers to bypass authentication on D-Link DAP-1650 wireless range extenders by accessing restricted web interface pages without credentials. Attackers can gain administrative access to the device's configuration interface. All users of affected DAP-1650 devices are vulnerable.
💻 Affected Systems
- D-Link DAP-1650 Wireless AC1200 Dual Band Range Extender
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attackers to change network settings, intercept traffic, install malicious firmware, or use the device as an entry point into the network.
Likely Case
Unauthorized access to device configuration leading to network disruption, DNS hijacking, or credential theft from connected devices.
If Mitigated
Limited impact if device is behind firewall with restricted web interface access, though authentication bypass remains possible.
🎯 Exploit Status
Forceful browsing (direct URL access) is trivial to perform. No special tools required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.04B02_J65H Hot Fix
Vendor Advisory: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DAP-1650/REVA/DAP-1650_REVA_RELEASE_NOTES_v1.04B02_J65H.pdf
Restart Required: Yes
Instructions:
1. Download firmware 1.04B02_J65H from D-Link support site. 2. Log into web interface. 3. Navigate to Tools > Firmware. 4. Upload and install the new firmware. 5. Device will reboot automatically.
🔧 Temporary Workarounds
Restrict Web Interface Access
allBlock external access to the device's web administration interface using firewall rules.
Change Default IP Range
allMove device to non-standard IP subnet to make discovery harder.
🧯 If You Can't Patch
- Isolate device on separate VLAN with strict firewall rules
- Disable remote administration and restrict web interface to specific management IPs only
🔍 How to Verify
Check if Vulnerable:
Attempt to access restricted pages like /bsc_lan.php or /bsc_wlan.php without authentication. If accessible, device is vulnerable.Check Version:
Log into web interface and check System Status page for firmware version.Verify Fix Applied:
After patching, attempt to access restricted pages without authentication. Should receive authentication prompt or error.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to admin pages
- Multiple failed login attempts followed by successful access to restricted pages
Network Indicators:
- HTTP requests to admin pages without preceding login requests
- Unusual configuration changes from unauthenticated IPs
SIEM Query:
http.url:"/bsc_*" AND NOT http.cookie:"*sid=*"