D-LINK DIR846 unauth configfile upload.MD

D-Link DIR-846 Unauthorized upload of configuration file

vender ：D-Link

Firmware version:100.26

Exploit Author: [email protected]

Vendor Homepage: http://www.dlink.com.cn/

Hardware Link:http://support.dlink.com.cn/ProductInfo.aspx?m=DIR-846

Vul detail

1. The vulnerable code is in file /squashfs-root/www/HNAP1/UploadSettings.php.
2. POC: