Conditional arbitrary file read in DIR-825ACG1

CVE: Pending (since the vendor ignored the report, I have to pursue it through MITRE)

Vendor: D-Link

Model: DIR-825ACG1

Hardware revision: R2

Firmware version: 1.12.0.08b1673-embedded

Firmware build date: Mon Mar 30 2020 3:33:00 PM MSK

Status: EOL device, reported with no vendor response

Introduction

I discovered this vulnerability during normal use of my router. A web interface endpoint accepts a file path as a parameter and loads it without sufficient input validation. By combining a double path traversal with filesystem access, arbitrary files can be read without authentication.

Discovery

While routinely logging into the router's admin interface, out of curiosity I opened developer tools (F12) and watched the requests. The concat endpoints carrying a file path struck me as an interesting target for path traversal:

⤢

My first attempt, trying to load a system file, returned an empty response with no error message. It struck me as suspicious that the request went through at all. But when I supplied a path to a non-existent file, the server returned 404. That confirmed my hypothesis: the server loads the file but cannot process it.

Existing file:

⤢

Non-existent file:

⤢

Mechanism Analysis

I was curious about the structure of the file the server loads, so I logged in over telnet and started looking for it. Because of the limited environment, I had to improvise a command that the restricted shell would run:

ls -R / 2>/dev/null | grep -C 5 "lib_js_list"

The output was as follows:

[...]
/srv/anweb/apps/admin:
templates
pages
modules
lib_js_list
js_list
index.html
img
global_js_list
general_css_list

One file in particular caught my attention, lib_js_list, because I had already seen it in the request. It turned out to contain file paths:

apps/admin/app.js
apps/admin/modules/history.js
apps/admin/modules/root_scope_interface.js
apps/admin/modules/snapper.js
apps/admin/modules/auth_interface.js
[...]

The paths in the file are relative to the working directory (presumably the web application's), not to the system root. Using path traversal, it is possible to cross this boundary.

Proof of Concept

Creating a custom list containing a path traversal sequence in the /tmp directory via telnet (in the router's shell):

echo ../../etc/passwd > /tmp/POC

Sending the request to the vulnerable endpoint (from the attacker's shell):

curl "http://192.168.0.1/concat?type=js&path=../../tmp/POC"

Result of the request:

admin:[...]:0:0:root:/:/bin/sh
nobody:x:99:99:nobody:/:/bin/false
ftp:x:500:500:ftp:/mnt:/bin/false

Root Cause Analysis

The bug stems from insufficient sanitization of user input. To pinpoint the exact spot where the problem occurs, I reverse engineered the anweb binary (the router's web server) in Ghidra.

The MIPS architecture was new to me and required some additional research, but with the help of the decompiled code I was able to identify the function concat_end_point, which handles HTTP requests for this endpoint.

That function then calls get_full_path, which builds the file path from the user input. The resulting path is formed by joining the fixed prefix /srv/anweb/ with the unvalidated user input, without any sanitization or canonicalization.

Relevant part of the get_full_path function:

⤢

Relevant part of the concat_end_point function:

⤢

Exploitation Constraints

Because the anweb binary loads the list from the filesystem, an attacker must either have physical access to the device (explained below) or know of another bug or feature that lets them write the list onto the filesystem. Unfortunately, I was not able to find a bug or feature that writes to the filesystem in a way the concat endpoint would successfully process.

Attack Vectors

The vulnerability requires that a file containing a custom list be present on the router's filesystem. I identified several ways to achieve this:

1. Samba (NAS feature)

The router supports file sharing over Samba. An attacker with access to the Samba server can upload a custom list. The default configuration does not allow this, and the attacker would need to know the system path to the shared folder.

2. Anonymous FTP

The router supports anonymous FTP login, although the default configuration does not enable it.

3. USB Flash Drive (most significant vector)

The router names USB devices deterministically (/mnt/usb1_0), owing to its single USB port. An attacker with physical access can abuse this to read arbitrary files without any authentication.

Impact

Successful exploitation allows reading arbitrary files from the system without authentication, including:

• /etc/passwd
• Router configuration files

Timeline

February 21, 2026 - Vulnerability discovered

February 21, 2026 - Reported to the vendor (D-Link)

April 22, 2026 - Deadline passed with no response

May 23, 2026 - Public disclosure (end-of-life device)

Recommendations

Users who actively rely on this device should consider replacing it with a model still supported by the vendor. If replacement is not possible, isolate the admin interface so it is not reachable from the internet or from untrusted networks (because even though the bug I found requires write access, an attacker might obtain that access through another vulnerability), and disable Samba, FTP, and physical access to the USB port.