D-Link DIR-816 Access Control Vulnerability in form2WlAc.cgi Allowing Unauthenticated MAC ACL Modification

An access control vulnerability has been identified in the D-Link DIR-816 router, specifically in the firmware version 816A2_FWv1.10CNB05_R1B011D88210. This vulnerability allows unauthenticated attackers to manipulate the MAC access control list for both the 2.4GHz and 5GHz bands. Exploitation is achieved by sending a crafted POST request to the device.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the MAC access control list, potentially leading to unauthorized network access or interference with network connectivity.

Reproduction

To reproduce this vulnerability, send a POST request to the DIR-816 router's form2WlAc.cgi component. The request must be crafted to include the desired changes to the MAC access control list for the 2.4GHz and 5GHz bands. No authentication is required to make this change.