CVE-2022-46076

Vulnerability

D-Link DIR-869 with firmware version DIR869Ax_FW102B15 (1.02B15) contains an authentication bypass vulnerability in the phpcgi component [1]. This component processes requests to .php, .asp, and .txt pages and is responsible for checking user authorization. A specially crafted request can bypass the authorization check.

Exploitation

An attacker with network access to the router can send a malicious request to phpcgi that bypasses the authorization checks [1]. The request can then execute a script that returns the router's login credentials (username and password). A proof-of-concept exploit is available [1].

Impact

Successful exploitation allows an unauthenticated attacker to retrieve the router's administrative credentials, leading to full compromise of the device [1]. The attacker can then modify settings, monitor traffic, and pivot into the internal network.

Mitigation

No official patch or firmware update has been released by D-Link for this vulnerability. The device may be end-of-life; users are advised to replace it with a supported model. D-Link's security bulletin does not list a specific fix for this issue [2].