D-Link DIR-816 A2 Improper Access Control Vulnerability in DDNS Service

A critical vulnerability has been identified in the D-Link DIR-816 A2 router, specifically in version 1.10CNB05_R1B011D88210. The issue resides within the DDNS service component, particularly in the '/goform/DDNS' file. This vulnerability allows for improper access control, enabling unauthorized users to manipulate DDNS settings remotely without authentication.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the DDNS configuration, potentially allowing attackers to redirect traffic or create denial-of-service conditions.

Reproduction

To reproduce this vulnerability, send an unauthenticated HTTP POST request to the '/goform/DDNS' endpoint. Include the 'DDNS' header to manipulate the DDNS service settings on the device.

Remediation

It is recommended to implement proper firewall rules to block unauthorized access to the vulnerable DDNS service.