CVE-2022-36526

Vulnerability

An authentication bypass vulnerability exists in D-Link GO-RT-AC750 routers, specifically in firmware versions GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02. The flaw resides in the phpcgi_main function within the cgibin component. The vulnerability allows an unauthenticated attacker to bypass authentication mechanisms, as the phpcgi_main function does not properly validate credentials when processing certain requests [1].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the cgibin endpoint that invokes the phpcgi_main function. No authentication is required, and the attacker can be positioned remotely on the network. The attack does not require user interaction or any prior knowledge of credentials [1].

Impact

Successful exploitation grants the attacker unauthenticated access to administrative functions of the router, effectively bypassing the login mechanism. This can lead to full compromise of the device, including unauthorized configuration changes, denial of service, or further network attacks [1].

Mitigation

As of the publication date, D-Link has not released a security advisory or patched firmware version for this specific vulnerability. Users are advised to check the D-Link Security Bulletin page [1] for updates. No workarounds are documented in the available references. The devices may be approaching or past end-of-life status; consult the D-Link EOL policy [1] for further guidance.