D-Link DAP-1360

D-Link DAP-1360

Security Grade F Calculator v1

D-Link DAP-1360 Brand: D-Link Category: Wireless N access point / range extender (SOHO 802.11n 2.4 GHz) • Model / Gen: DAP-1360 Rev. F1 (F-series hardware); assessment scoped to firmware v6.14b01 and below, patched only by beta hotfix v6.15EUb01 Release Date: 2011-01-01 • Status: End of life Classification Date: 2026-10-23 • [supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 Official Website]

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	[ftp.dlink.de/dap/dap-1360/documentation/DAP-1360_man_revc_Manual_en.pdf 🔗 Proof]	Documentary assessment, NOT device testing. The opened official user manual describes a sealed SOHO access point/repeater with no documented physical-tampering feature; no documented tampering campaign appears in opened sources.
Known vulnerabilities	Very common	[nvd.nist.gov/vuln/detail/CVE-2023-32145 🔗 Proof]	Documentary assessment, NOT device testing. Based on documented ZDI findings on DAP-1360 F-series firmware v6.14b01 and below: CVE-2023-32145 hard-coded credentials authentication bypass (CWE-798/CWE-259, ZDI-CAN-18455), CVE-2023-32143 unauthenticated root RCE via /cgi-bin/webupg UPGCGI_CheckAuth numeric truncation (CWE-197, ZDI-CAN-18423), CVE-2023-32136 unauthenticated root RCE via /cgi-bin/webproc var:menu stack-based buffer overflow (CWE-121, ZDI-CAN-18414); D-Link advisory SAP10324 lists 11 ZDI-reported weaknesses on the same firmware range (multiple stack/heap buffer-overflow RCEs, directory-traversal info disclosure).
Prior attacks	Rare	[www.zerodayinitiative.com/advisories/ZDI-23-537/ 🔗 Proof]	Documentary assessment, NOT device testing. Coordinated public ZDI disclosure (May 2023) with technical detail; opened sources document no observed mass compromise campaign or botnet membership specific to DAP-1360, so active compromise history is assessed Rare.
Updatability	None	[supportannouncement.us.dlink.com/iframe/recentannouncement_m.aspx 🔗 Proof]	Documentary assessment, NOT device testing. D-Link's current announcement list declares "DAP-1360: All Hardware Revisions / All Firmware Versions : End-of-Life (EoL) / End-of-Service (EoS) : Vulnerabilities Reported"; the only fix ever issued for the 2023 ZDI set was a beta hotfix v6.15EUb01 (SAP10324, 2023-01-17), after which maintenance ceased, so ongoing updatability is None.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	No	[ftp.dlink.de/dap/dap-1360/documentation/DAP-1360_man_revc_Manual_en.pdf 🔗 Proof]	Documentary assessment, NOT device testing. The manual documents a standalone local web configuration utility only; no cloud account, SSO, or external identity-system integration is described.
Communications	No encryption	[ftp.dlink.de/dap/dap-1360/documentation/DAP-1360_man_revc_Manual_en.pdf 🔗 Proof]	Documentary assessment, NOT device testing. The manual directs the administrator to open the utility over plain dlinkap or 192.168.0.50; no HTTPS management channel is documented (WPA/WPA2 applies only to the wireless radio).
Storage	No encryption	[nvd.nist.gov/vuln/detail/CVE-2023-32145 🔗 Proof]	Documentary assessment, NOT device testing. CVE-2023-32145 documents hard-coded default credentials embedded in firmware that bypass authentication; opened official materials describe no encrypted-at-rest configuration or credential store.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	[ftp.dlink.de/dap/dap-1360/documentation/DAP-1360_man_revc_Manual_en.pdf 🔗 Proof]	Documentary assessment, NOT device testing. The manual provides a single Admin account with a password-change page only; no multi-user or role-based management.
Authentication	Basic	[nvd.nist.gov/vuln/detail/CVE-2023-32143 🔗 Proof]	Documentary assessment, NOT device testing. Web login relies on a single local password over plain HTTP and is undermined by hard-coded credentials (CVE-2023-32145) and unauthenticated RCE endpoints (CVE-2023-32143, CVE-2023-32136); no MFA documented.
Brute-force protection	Absent	[ftp.dlink.de/dap/dap-1360/documentation/DAP-1360_man_revc_Manual_en.pdf 🔗 Proof]	Documentary assessment, NOT device testing. The opened manual describes no login lockout, throttling, or brute-force countermeasure.
Event logging	Absent	[ftp.dlink.de/dap/dap-1360/documentation/DAP-1360_man_revc_Manual_en.pdf 🔗 Proof]	Documentary assessment, NOT device testing. The opened official manual documents no authentication-event logging or audit facility.
Passwords	Default/Common/Easy to guess	[ftp.dlink.de/dap/dap-1360/documentation/DAP-1360_man_revc_Manual_en.pdf 🔗 Proof]	Documentary assessment, NOT device testing. Factory default login is user name Admin with a blank password per the Rev.C manual (other revisions ship admin/admin); CVE-2023-32145 additionally documents hard-coded credentials in firmware; no forced rotation or complexity requirement documented.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	proprietary embedded firmware (webproc/webupg CGI management, no documented Linux userspace in opened sources) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass: