Information Disclosure via DHCP Client Handler in D-Link Routers

Executive Summary

CVE-2026-2055 is an information disclosure vulnerability affecting D-Link DIR-605L and DIR-619L routers running firmware versions 2.06B01 and 2.13B01.

The flaw exists in an unknown function within the DHCP Client Information Handler component, where manipulation with unspecified input leads to unauthorized disclosure of sensitive information.

Specifically, improper access controls and incorrect privilege assignments allow an attacker to access certain router web interface pages (dhcp_clients.asp, dyn_clients_only.asp, wifi_assoc.asp) without any authentication.

This unauthorized access exposes sensitive network information, including DHCP client details and Wi-Fi client data.

The vulnerability can be exploited remotely without authentication, and a public proof-of-concept exploit is available.

The affected products are no longer supported by the vendor.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive network information, such as DHCP client details and Wi-Fi client associations.

An attacker can remotely access this information without any authentication, potentially gaining insights into your network configuration and connected devices.

Such information disclosure can be used to facilitate further attacks or reconnaissance against your network.

Since the affected devices are no longer supported, no official patches are available, increasing the risk if the devices remain in use.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by checking if your network devices are D-Link DIR-605L or DIR-619L routers running firmware versions 2.06B01 or 2.13B01. Since the vulnerability allows unauthorized access to specific router web interface pages without authentication, you can attempt to access the following URLs on the router's web interface to verify exposure: dhcp_clients.asp, dyn_clients_only.asp, and wifi_assoc.asp."}, {'type': 'paragraph', 'content': 'To detect exploitation attempts or verify vulnerability, you can use network scanning or HTTP request commands such as:'}, {'type': 'list_item', 'content': 'curl -I http://[router_ip]/dhcp_clients.asp'}, {'type': 'list_item', 'content': 'curl -I http://[router_ip]/dyn_clients_only.asp'}, {'type': 'list_item', 'content': 'curl -I http://[router_ip]/wifi_assoc.asp'}, {'type': 'paragraph', 'content': 'If these pages respond without requiring authentication, the device is vulnerable. Additionally, monitoring network traffic for unauthorized access to these pages can help detect exploitation attempts.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Since the affected D-Link DIR-605L and DIR-619L devices are no longer supported by the vendor, no firmware patches are available. Immediate mitigation involves restricting access to the vulnerable devices.'}, {'type': 'list_item', 'content': "Implement strict firewall rules to block remote access to the router's web interface, especially blocking access to the vulnerable pages (dhcp_clients.asp, dyn_clients_only.asp, wifi_assoc.asp) from untrusted networks."}, {'type': 'list_item', 'content': 'Limit management access to the router to trusted internal networks only.'}, {'type': 'list_item', 'content': 'If possible, replace the affected devices with supported hardware that receives security updates.'}] [2]

Useful 0 Not Useful 0