Dear Tim Brown,

This vulnerability for D-Link DSL-G624T was already reported by Jose
Ramon Palanco. See

http://securityvulns.ru/Odocument816.html

Previously, same problem was reported for D-Link DSL-G604T by Qex

http://securityvulns.ru/Mdocument578.html


There were also few more problems reported about /cgi-bin/webcm, see

http://securityvulns.ru/Idocument664.html
http://securityvulns.ru/Idocument759.html



--Thursday, May 3, 2007, 2:43:58 AM, you wrote to news@securiteam.com:

TB> Hi,

TB> I've identified a couple of security flaws affecting the DSL-G624T fi=
rmware.
TB> I believe the directory traversal issue has been reported in other de=
vices /
TB> firmware versions supplied by D-Link but not the combination I tested=
and
TB> clearly has not been resolved. Additionally, the Javascript injectio=
n issue
TB> is I believe new and has not been reported on any device.

TB> These issues were reported by email to the vendor at the usual addres=
ses
TB> (support/security/etc) without response on 13th April 2007. I also a=
ttempted
TB> to log faults on the vendors support web site but sadly, it would not
TB> function adequately using either Firefox nor Konqueror.

TB> Tim


--=20
~/ZARAZA http://securityvulns.com/
=C5=F1=EB=E8 =E4=E0=E6=E5 =E2=FB =EF=EE=EB=F3=F7=E8=F2=E5 =EA=E0=EA=EE=E5=
-=ED=E8=E1=F3=E4=FC =EF=E8=F1=FC=EC=EE, =E2=FB =E2=F1=E5 =F0=E0=E2=ED=EE =
=ED=E5 =F1=F3=EC=E5=E5=F2=E5 =E5=E3=EE =EF=F0=EE=F7=E8=F2=E0=F2=FC. (=D2=E2=
=E5=ED)