D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability

Vulnerability

The vulnerability resides in the HNAP LoginPassword functionality of the web management interface on D-Link DIR-2640 routers, which listens on TCP port 80 by default. A specially crafted login request can cause authentication to succeed without providing proper credentials. Affected firmware versions are v1.11B02 and v1.11B02 Beta01 (and below) on hardware revision Ax. [1][2]

Exploitation

An attacker positioned on the same network as the router (network-adjacent) can exploit this vulnerability without any authentication or user interaction. The attacker sends a specially crafted login request to the web management interface, which bypasses the authentication check. [2]

Impact

Successful exploitation allows the attacker to bypass authentication and gain administrative access to the router's management interface. According to the CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), the impact is limited to integrity compromise; the attacker can modify router settings but cannot read sensitive data or cause a denial of service. [2]

Mitigation

D-Link has released a hotfix firmware version v1.11B02_Beta_Hotfix to address this vulnerability. Users are advised to update to the latest firmware available from D-Link's support page. No workaround is provided. [1]