D-Link DIR-815

D-Link DIR-815
Security Grade F Calculator v	Wireless N Dual Band Router (DIR-815) Brand: D-Link Category: Router • Model / Gen: DIR-815 A1 Release Date: 2010-10-18 • Status: End of life Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Qualitative physical-access judgment: exact A1 board JP1 TX/RX, serial boot menu writes firmware/bootloader via TFTP/serial. Not measured tampering incidence or reset alone.
Known vulnerabilities	Very common	[1] 🔗 Proof	Qualitative multiple historical flaws, not statistics: A1v1.01 shared telnet secret, tested UPnP injection, vendor hedwig/service.cgi issues. Each advisory has its own version scope.
Prior attacks	Rare	[2] 🔗 Proof	Qualitative: actual controlled A1v1.00 root/reboot exploitation(2013); Unit42 observed2019 Mirai sample DIR815 targeting capability. Not exact victim infection, population or Dyn attribution.
Updatability	None	🔗 Proof	Current OEM maintenance: vendor all revisions EOL/EOS2017-12-29, no ongoing development. None is maintenance cadence, not technical inability to flash old firmware or third-party support.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[3] 🔗 Proof	Mixed capability: WPA/WPA2 PSK/EAP and RADIUS shared secret; tested unauthenticated local UPnP commands. Partial, not mandatory mutual authentication for all services.
Communications	No encryption	🔗 Proof	Historical local HTTP management only: model-tested Metasploit login module sends login_plaintext/PASSWD via HTTP. Not all traffic; WPA2/AES available on separate wireless link.
Storage	No encryption	[4] 🔗 Proof	Sensitive system secret only: A1v1.01 report recovers literal working telnet secret from flash-backed rootfs image_sign; A1 board boot shows NOR/SquashFS. Not every flash/user-data item.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	A1 manualp71: fixed administrator password controls. Basic, not arbitrary account creation/deletion or flexible roles; no device test.
Authentication	Basic	[5] 🔗 Proof	Normal administrator web login exists; A1v1.01 paper shows shared hardcoded telnet login yielding shell. Basic weak/mixed authentication, not absence of login.
Brute-force protection	Basic	🔗 Proof	A1 manualp71 optional distorted-letter/number graphical login challenge. Basic capability, not default enabled, comprehensive lockout or rate limiting.
Event logging	Partial logging	🔗 Proof	A1 manualp80: System/Firewall&Security/RouterStatus logs, severity, export/syslog. Partial; comprehensive success/failure administrator-login auditing not established.
Passwords	Default/Common/Easy to guess	🔗 Proof	A1 manual: administrator password blank by default and change controls. Setup password advice is not mandatory later change; A1v1.01 also has shared hardcoded telnet credential.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Historical OEM A1: testedv1.00; shared-secretv1.01; current maintenance EOL (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Documentary assessment, NOT device testing/current certification. Original DIR815A1 only, not AC/R4/S1/B1. Snapshots: testedv1.00, secretv1.01, present maintenanceEOL. Rare/Very common qualitative assessor judgments, not measured frequency. HTTP management and flash-backed sensitive system secret ONLY, not all traffic/all user data; optional WPA2 exists. Graphical login protection is optional capability, not default. Actual controlled root exploitation is distinct from observed malware targeting capability; no proven exact victim infection count or Dyn participation. Date2010-10-18 is ANZ regional introduction/available-now, not global first launch or first shipment. Vendor-authored announcement mirrored at https://manuals.plus/m/98a08550d9b4a86bca21b32f2e6e73a9df387d4cad70c5ebb1c76c3aad618f5e.pdf; vendor-hosted original unrecovered, announcement does not explicitly name hardware revision. Manual cover identifies originalA1.