Submeter #929152: D-Link DIR-882 A1 Information Disclosure

D-Link DIR-882 A1 contains an unauthenticated information disclosure vulnerability in the /HNAP1/dllog.cgi and /HNAP1/dlquickvpnsettings.cgi endpoints.

The embedded lighttpd web server directly executes the corresponding CGI binaries without requiring administrator authentication. Reverse engineering confirms that the main() functions of both affected CGI binaries do not perform authentication or authorization checks.

An unauthenticated remote attacker can access /HNAP1/dllog.cgi to retrieve system diagnostic information. The returned data includes /var/log/messages, memory usage information from free, running process information from ps, and network interface information from ifconfig.

An unauthenticated remote attacker can also access /HNAP1/dlquickvpnsettings.cgi to retrieve the VPN configuration file /tmp/vpnprofile.mobileconfig. The CGI program directly opens and reads the complete file and returns it to the HTTP client.

Example requests:
curl "http://192.168.0.1/HNAP1/dllog.cgi?Message1" --output test1.txt
curl "http://192.168.0.1/HNAP1/dlquickvpnsettings.cgi?Message2" --output test2.txt

No authenticated administrator session or valid credentials are required to access either endpoint.

The disclosed information exposes system logs, running processes, network interface information, memory information, and VPN configuration information. This information can reveal details about the device runtime environment, network configuration and VPN infrastructure and can assist an attacker in identifying and targeting additional services or interfaces.

• Fonte: ⚠️ https://github.com/limou89/somevul/blob/main/D-Link_DIR-882_A1_dllog_dlquickvpnsettings_Information_Disclosure.md
• Utilizador: sleep (UID 100148)
• Submissão: 14/08/2026 12h19 (há 1 mês)
• Moderação: 14/09/2026 09h19 (1 month later)
• Estado: Aceite
• Entrada VulDB: 403475 [D-Link DIR-882 até 20260814 CGI Binary /HNAP1/dllog.cgi main Divulgação de Informação]
• Pontos: 20