Summary
Multiple D-Link DIR series routers are prone to a local file- disclosure vulnerability. fails to adequately validate user- supplied input.
Impact
Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on devices running the vulnerable application. This may aid in further attacks.
Solution
Ask the Vendor for an update.
Insight
The remote D-Link device fails to adequately validate user supplied input to 'REQUIRE_FILE' in '__show_info.php'
Affected
D-Link DIR-615
D-Link DIR-300
DIR-600
Detection
Send a crafted HTTP GET request which tries to read '/var/etc/httpasswd'
References
Updated on 2015-03-25
