D-Link DIR-842 HNAP Authentication Bypass Enables Arbitrary Code Execution

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083.

• The normalized record identifies D-Link DIR-842 firmware 3.13B05 as affected.
• D-Link's advisory lists DIR-842 across all Cx hardware revisions, with firmware v3.13B09 and below affected.
• D-Link lists v3.13b10 Hotfix as fixed for the scope described in that advisory.
• The available sources do not establish the status of non-Cx hardware revisions or parallel release branches.

The flaw is in the D-Link DIR-842 firmware component that processes HNAP GetCAPTCHAsetting requests. The reported cause is improper session handling, classified as CWE-303, Incorrect Implementation of Authentication Algorithm. A network-adjacent attacker can submit the request without valid authentication or user interaction. The failure permits authentication bypass and, according to the source description, arbitrary code execution in the context of the device. The available evidence does not identify the malformed fields, exact session-state transition, vulnerable function, or payload used to reach code execution.

The vulnerability is reachable over the network from an adjacent position. Authentication is not required, and the available record indicates that no user interaction is required and that exploitation complexity is low. The relevant processing point is the HNAP GetCAPTCHAsetting request. Active exploitation and the availability of a public exploit are not established by the record or the public material reviewed.

Successful exploitation can bypass authentication for the HNAP processing path and enable arbitrary code execution in the D-Link DIR-842 device context. This could affect the confidentiality, integrity, and availability of the router and services that depend on it. The source does not confirm operating-system-level privileges, lateral movement, or direct impact on other systems. The practical post-exploitation scope depends on the privileges of the affected device process and its deployment configuration, which are not described.

Successful exploitation could remove the router's authentication boundary and permit unauthorized code execution in the device context. Possible consequences include unauthorized configuration changes, exposure of information handled by the router, and disruption of network services, but the sources do not establish a specific intrusion or campaign. Because the flaw requires no authentication and is reachable from an adjacent network, DIR-842 devices on shared or insufficiently trusted network segments should receive priority for review. The precise post-exploitation control available to an attacker is not described.

1. Upgrade D-Link DIR-842 devices on Cx hardware revisions to v3.13b10 Hotfix, which D-Link lists as the fixed firmware.
2. Confirm the hardware revision from the label on the underside of the device or from the web configuration interface before selecting the corresponding firmware.
3. Prioritize devices running v3.13B09 or below, especially when they are reachable from untrusted adjacent networks.
4. D-Link describes the fix as beta firmware or a hot-fix still undergoing final testing and supplied on an as-is basis. The available sources do not provide a confirmed interim mitigation other than applying the firmware update.

1. Inventory D-Link DIR-842 routers and identify each hardware revision from the device label or web administration interface.
2. Check the installed firmware version and compare it with the affected boundaries in affected_summary.
3. If telemetry is retained, review HNAP GetCAPTCHAsetting requests from unauthenticated adjacent clients and authentication anomalies. This is precautionary review guidance, not a confirmed indicator of compromise.
4. After remediation, verify that the firmware and configuration match the approved baseline. The absence of matching log entries does not prove that a device is safe.