| शीर्षक | D-Link DIR-882 A1 Information Disclosure |
|---|
| विवरण | D-Link DIR-882 A1 contains an unauthenticated information disclosure vulnerability in the /HNAP1/dllog.cgi and /HNAP1/dlquickvpnsettings.cgi endpoints.
The embedded lighttpd web server directly executes the corresponding CGI binaries without requiring administrator authentication. Reverse engineering confirms that the main() functions of both affected CGI binaries do not perform authentication or authorization checks.
An unauthenticated remote attacker can access /HNAP1/dllog.cgi to retrieve system diagnostic information. The returned data includes /var/log/messages, memory usage information from free, running process information from ps, and network interface information from ifconfig.
An unauthenticated remote attacker can also access /HNAP1/dlquickvpnsettings.cgi to retrieve the VPN configuration file /tmp/vpnprofile.mobileconfig. The CGI program directly opens and reads the complete file and returns it to the HTTP client.
Example requests:
curl "http://192.168.0.1/HNAP1/dllog.cgi?Message1" --output test1.txt
curl "http://192.168.0.1/HNAP1/dlquickvpnsettings.cgi?Message2" --output test2.txt
No authenticated administrator session or valid credentials are required to access either endpoint.
The disclosed information exposes system logs, running processes, network interface information, memory information, and VPN configuration information. This information can reveal details about the device runtime environment, network configuration and VPN infrastructure and can assist an attacker in identifying and targeting additional services or interfaces. |
|---|
| स्रोत | ⚠️ https://github.com/limou89/somevul/blob/main/D-Link_DIR-882_A1_dllog_dlquickvpnsettings_Information_Disclosure.md |
|---|
| उपयोगकर्ता | sleep (UID 100148) |
|---|
| सबमिशन | 14/08/2026 12:19 PM (1 महीना पहले) |
|---|
| संयम | 14/09/2026 09:19 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403475 [D-Link DIR-882 तक 20260814 CGI Binary /HNAP1/dllog.cgi main सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|