Skip to content
Full exploit for D-Link DCS-5020L, POC crash for others that are vulnerable as well.
Branch: master
Clone or download
Latest commit eca9fc4 Mar 2, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
DlinkExploit Removed files that never should have been commited Feb 7, 2019 Converted to Python3. Made a framework for the overflows and tested a… Feb 7, 2019

D-Link Exploit

The exploit exists in the devices server, alphapd, when processing wireless.htm prior to displaying it to the user. If WEPEncryption is provided in the URL this leads to a buffer overflow if the value is longer than 0x28 bytes. A URL of the form:


will exercise the exploit and begin executing at 0x42424242.

Note: The exploit requires credentials to be successful. Default credentials are admin with a blank password.

Full exploit that takes advantage of a buffer overflow in the alphapd server to execute an arbitrary command on the device. It has been tested on the DCS-5020L with all available versions of the firmware as well as the most recent firmware of the DCS-930L. More devices and versions can be added by reading the comments in the overflow file. I might add more devices and versions as time permits, but it's not a high priority. The initial commit of this project has some simpler Python2 examples.

Vulnerable Devices

Below is the list of devices effected by this exploit. All versions of the firmware are currently vulnerable.











Live Vulnerable Devices

Example Usage

This project is written in Python 3 and will not execute under Python 2.

python3 -i -P 80 -u admin -p ""

In-depth Explaination Skip to 13:15 to hear about the actual exploit.

You can’t perform that action at this time.