D-Link DIR-882 vulnerabilities

A vulnerability was detected in D-Link DIR-882 up to version 20260814. It affects the main function in /HNAP1/dllog.cgi of the CGI Binary component. Manipulation leads to information disclosure. The attack can be launched remotely, and the exploit is public.

A command injection vulnerability exists in the D-Link DIR-882 router firmware DIR882A1_FW102B02 within the prog.cgi and rc binaries. User-supplied email configuration parameters are stored in NVRAM and later concatenated into shell commands without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.

A command injection vulnerability exists in the D-Link DIR-882 router firmware DIR882A1_FW102B02 within the prog.cgi and librcm.so binaries. The SetDMZSettings/IPAddress value is stored in NVRAM and later concatenated into iptables shell commands without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.