Various D-Link DSL routers are susceptible to a remote authentication bypass vulnerability.

This vulnerability allows remote attackers to gain complete administrative access to affected devices.

Ask the Vendor for an update.

By setting the User-Agent header to 'xmlset_roodkcableoj28840ybtide', it is possible to access the web interface without any authentication.

Various D-Link routers are affected.

Try to bypass authentication by using 'xmlset_roodkcableoj28840ybtide' as HTTP User-Agent.

• http://www.d-link.com/
• http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/

---

Updated on 2015-03-25