| D-Link DIR-645
|
|
Security Grade
Calculator v
|
Wireless N Home Router with SmartBeam technology (DIR-645)
Category: Router • Model / Gen: DIR-645 hardware A1 / Ax
Release Date: 2011-09-12 • Status: End of life
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
π Proof
|
Qualitative local-modification susceptibility, not incidence: exact-board docs show serial access, flash layout and recovery/reflash. Not inferred solely from reset button.
|
| Known vulnerabilities
|
Very common
|
[1] π Proof
|
Qualitative Very common: multiple documented historical flaws (HNAP command injection, A1v1.03 shared telnet secret, older account disclosure). Not measured CVE frequency; per-version limits apply.
|
| Prior attacks
|
Very common
|
[2] π Proof
|
Qualitative repeated campaigns: captured Goldoon attempts Apr2024; FICORA/CAPSAICIN telemetry Oct-Nov2024. DIR645Ax<=1.04b12 scope; not per-model infection counts/every target compromised.
|
| Updatability
|
None
|
π Proof
|
Present OEM maintenance only: vendor states EOL/EOS, no further development/support. None means no ongoing vendor updates, NOT inability to load historical firmware; third-party firmware excluded.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
[3] π Proof
|
Partial mixed-service capability: WPA/WPA2 PSK or EAP/RADIUS supported; vulnerable HNAP path unauthenticated. Not universally mandatory mutual auth or firmware-signature assessment.
|
| Communications
|
No encryption
|
π Proof
|
Historical local HTTP management channel (manual p10 http://dlinkrouter), not all traffic. Optional WPA2/AES protects a different link; not a device test.
|
| Storage
|
No encryption
|
[4] π Proof
|
A1v1.03 sensitive system-secret scope: researcher extracts literal working telnet secret in flash-backed rootfs image_sign file; board layout shows SquashFS. Compression is not encryption; not all flash data.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
π Proof
|
Manual p90: fixed Admin/User password controls. Basic, not arbitrary account creation/deletion or flexible role management.
|
| Authentication
|
Basic
|
[5] π Proof
|
Normal admin/password login exists, but A1v1.03 research documents shared hard-coded telnet login yielding shell. Basic mixed/weak auth, not no login at all.
|
| Brute-force protection
|
Basic
|
π Proof
|
Manual p90 optional graphical login confirmation supports Basic capability. Not default-on, full lockout or rate-limit claim.
|
| Event logging
|
Partial logging
|
π Proof
|
Manual p106 documents System/Firewall&Security/RouterStatus logs, severity, export/syslog. Partial logging; comprehensive administrator access auditing not established.
|
| Passwords
|
Default/Common/Easy to guess
|
π Proof
|
Historical manuγal p10: Admin password blank by default, p90 change controls. Setup advice not mandatory post-setup change; A1v1.03 also shared telnet credential.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Historical stock A1 firmware; v1.03 secrets, Ax<=1.04b12 attacks; present OEM EOL maintenance (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Documentary historical original DIR-645A1/Ax assessment, not hardware testing/current certification. Different source snapshots explicitly: hardcoded-secret research A1v1.03; campaign affectedAx<=1.04b12; present OEM no-maintenance status. Rare/Very common qualitative judgments, not prevalence statistics. HTTP management and sensitive flash-backed system secret only; optional WPA2 encryption exists. CAPTCHA is optional login capability not factory-on. Date2011-09-12 is UK regional launch announcement, NOT earliest/global first shipment (US family announced earlier): https://www.dlink.com/uk/en/press-centre/press-releases/2011/september/12/dir-645-and-dir-657. Captured exploit attempts not counted successful infections. All mandatory sources retained; optional unknown hardware specs omitted.
