News for hackers. Stuff that matters.

A comment on Command Injection and Backdoor Account in D-Link NAS Devices.

Re:Command Injection and Backdoor Account in D-Link NAS Devices by NKosmatos on Sunday April 07, 2024 @09:15AM (#39960552)
The thing of interest is that although the DNS-320L, and the other D-Link NASes, is EOL (End Of Life), there are more than 90,000 devices still operating out there!

The bad thing here is that many manufacturers, even big ones, tend to forget “old” products and drop support for them. Usually it’s a market/business decision, but this is what happens with closed systems :-(

Quoting from https://www.dlink.com/uk/en/products/dns-320l-sharecenter-2-... :

>> This product was phased out on: 13/11/2017

>> This product's last date of support is on: 13/11/2019

Being an owner of 320L, I don’t expect D-Link to offer us an updated firmware any time soon.

[ Parent | on HN ]
Re:Command Injection and Backdoor Account in D-Link NAS Devices by bchanudet on Sunday April 07, 2024 @12:21PM (#39961769)
Sometime ago I found an alternative "OS" for my DNS-320L called Alt-f [0]. Granted its UI is very old-school but it has worked flawlessly. There has been no release since 2022 but at least it's more recent than the last official firmware (and I assume is not impacted by the vulnerability).

IIRC I didn't even had to format or move the data I had on it before installing.

[0] https://sourceforge.net/projects/alt-f/

[ Parent | on HN ]
Re:Command Injection and Backdoor Account in D-Link NAS Devices by pierrec on Sunday April 07, 2024 @11:19AM (#39961338)
>I don’t expect D-Link to offer us an updated firmware any time soon

Don't worry, some botnet will infect all of these and fix the vulnerability in order to prevent competing malware from gaining access. This fix will deploy within an impressively tight timeline.

[ Parent | on HN ]
Re:Command Injection and Backdoor Account in D-Link NAS Devices by captn3m0 on Sunday April 07, 2024 @10:38AM (#39961083)
Is there a better way to track D-Link EOLs? Would be nice to have this up at the endoflife.date.
[ Parent | on HN ]
Re:Command Injection and Backdoor Account in D-Link NAS Devices by IYasha on Monday April 08, 2024 @06:09AM (#39968119)
Yeah it's not even surprising - does ANYONE in their right mind go through all their gadgets/home appliances to check their EOL status?? The whole reason for buying a completely set up and ready to go device that you don't configure yourself is to "put it and forget it". And that is the part when manufacturers screw you. (I myself am running 10+yo hardware and pretty happy about it.)
[ Parent | on HN ]