제출 #929152: D-Link DIR-882 A1 Information Disclosure

D-Link DIR-882 A1 contains an unauthenticated information disclosure vulnerability in the /HNAP1/dllog.cgi and /HNAP1/dlquickvpnsettings.cgi endpoints.

The embedded lighttpd web server directly executes the corresponding CGI binaries without requiring administrator authentication. Reverse engineering confirms that the main() functions of both affected CGI binaries do not perform authentication or authorization checks.

An unauthenticated remote attacker can access /HNAP1/dllog.cgi to retrieve system diagnostic information. The returned data includes /var/log/messages, memory usage information from free, running process information from ps, and network interface information from ifconfig.

An unauthenticated remote attacker can also access /HNAP1/dlquickvpnsettings.cgi to retrieve the VPN configuration file /tmp/vpnprofile.mobileconfig. The CGI program directly opens and reads the complete file and returns it to the HTTP client.

Example requests:
curl "http://192.168.0.1/HNAP1/dllog.cgi?Message1" --output test1.txt
curl "http://192.168.0.1/HNAP1/dlquickvpnsettings.cgi?Message2" --output test2.txt

No authenticated administrator session or valid credentials are required to access either endpoint.

The disclosed information exposes system logs, running processes, network interface information, memory information, and VPN configuration information. This information can reveal details about the device runtime environment, network configuration and VPN infrastructure and can assist an attacker in identifying and targeting additional services or interfaces.

• 원천: ⚠️ https://github.com/limou89/somevul/blob/main/D-Link_DIR-882_A1_dllog_dlquickvpnsettings_Information_Disclosure.md
• 사용자: sleep (UID 100148)
• 제출: 2026. 08. 14. PM 12:19 (1 월 ago)
• 모더레이션: 2026. 09. 14. AM 09:19 (1 month later)
• 상태: 수락
• VulDB 항목: 403475 [D-Link DIR-882 까지 20260814 CGI Binary /HNAP1/dllog.cgi main 정보 공개]
• 포인트들: 20