提出 #929152: D-Link DIR-882 A1 Information Disclosure

D-Link DIR-882 A1 contains an unauthenticated information disclosure vulnerability in the /HNAP1/dllog.cgi and /HNAP1/dlquickvpnsettings.cgi endpoints.

The embedded lighttpd web server directly executes the corresponding CGI binaries without requiring administrator authentication. Reverse engineering confirms that the main() functions of both affected CGI binaries do not perform authentication or authorization checks.

An unauthenticated remote attacker can access /HNAP1/dllog.cgi to retrieve system diagnostic information. The returned data includes /var/log/messages, memory usage information from free, running process information from ps, and network interface information from ifconfig.

An unauthenticated remote attacker can also access /HNAP1/dlquickvpnsettings.cgi to retrieve the VPN configuration file /tmp/vpnprofile.mobileconfig. The CGI program directly opens and reads the complete file and returns it to the HTTP client.

Example requests:
curl "http://192.168.0.1/HNAP1/dllog.cgi?Message1" --output test1.txt
curl "http://192.168.0.1/HNAP1/dlquickvpnsettings.cgi?Message2" --output test2.txt

No authenticated administrator session or valid credentials are required to access either endpoint.

The disclosed information exposes system logs, running processes, network interface information, memory information, and VPN configuration information. This information can reveal details about the device runtime environment, network configuration and VPN infrastructure and can assist an attacker in identifying and targeting additional services or interfaces.

• ソース: ⚠️ https://github.com/limou89/somevul/blob/main/D-Link_DIR-882_A1_dllog_dlquickvpnsettings_Information_Disclosure.md
• ユーザー: sleep (UID 100148)
• 送信: 2026年08月14日 12:19 (1 月 ago)
• モデレーション: 2026年09月14日 09:19 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 403475 [D-Link DIR-882 迄 20260814 CGI Binary /HNAP1/dllog.cgi main 情報漏えい]
• ポイント: 20