CVE-2017-8415

Vulnerability

The D-Link DCS-1100 and DCS-1130 devices (exact firmware versions not specified) contain a custom telnet daemon as part of BusyBox. The daemon retrieves the password hash from /etc/shadow using the getspnam function at address 0x00053894, then performs a crypt operation on the user-provided password at address 0x000538E0 and compares it with the stored hash via strcmp at address 0x00053908. Because the /etc/shadow file resides on a CRAMFS read-only filesystem, the password hash cannot be changed by the user. The hash is a salted hash of the string "admin", effectively making "admin" the hardcoded, unchangeable password [1] [2].

Exploitation

An attacker with network access to the device can connect to the telnet service and authenticate using the credentials admin / admin, since the hash matches that default password. No authentication bypass or privilege escalation is required; the attacker simply uses the known default credentials that cannot be altered [1] [2].

Impact

Successful authentication via telnet grants the attacker a shell with elevated privileges (likely root, as typical for embedded device telnet daemons). This leads to full compromise of the device, including the ability to read sensitive data, modify device configuration (if not fully read-only), and potentially use the device as a pivot point in the network [1] [2].

Mitigation

D-Link has not released firmware updates for the DCS-1100 and DCS-1130 (both devices appear to be end-of-life). No official patch exists. The only effective mitigation is to disable the telnet service on the device (if possible via web interface) or isolate the device on a separate, restricted network segment. The device should not be exposed to the internet [1] [2].