Shodan has turned up half a million D-Link devices exposed to the internet, and subject to easy hijacking using zero-day vulnerabilities.
The stack overflow vulnerabilities affect more than 120 D-Link products, from Wi-Fi cameras to routers and modems, and allow remote attackers to completely hijack the administer account of the devices to install backdoors and intercept traffic.
D-Link has been contacted for comment.
It takes only one command to exploit the flaw, according to Senrio researchers who published a proof-of-concept that changed administrator passwords.
“… the Senrio research team discovered and exploited a remote code execution vulnerability in the latest firmware of the D-Link DCS-930L Network Cloud Camera,” the researchers say.
“While the thought of strangers watching your sleeping baby is disturbing, the implications for enterprise and infrastructure environments are downright scary.”
Almost 140,000 of the devices are located in the US, with 23,442 in Canada, and 20,982 in Sweden.
Founder Stephen Ridley told Security Week attacking the 120-odd D-Link device models requires to exploit tweaking to suit different firmware.
“An attacker would practically account for this difference in versions [and] devices by fingerprinting a device, and then changing the exploit payload based on the target,” Ridley says.