Secunia

A security issue has been reported in D-Link DWL-2100AP, D-Link DWL-7000AP, and D-Link DWL-7100AP, which can be exploited by malicious people to disclose sensitive information.

The problem is caused due to configuration files being stored insecurely inside the "cgi-bin" directory. This can be exploited to disclose the administrator's username and password, and other device configuration information without being authenticated by requesting the configuration file directly via the web interface.

Example:
http://[host]/cgi-bin/[file].cfg

The security issue has been reported in D-Link DWL-2100AP firmware version 2.10na. Other versions may also be affected.

Solution
Filter traffic to the web interface of an affected device.

Provided and/or discovered by
Wendel Guglielmetti Henrique and Intruders Tiger Team Security.

Reported in D-Link DWL-7000AP by Nhan NGO DINH.
Reported in D-Link DWL-7100AP by Niklas.

Changelog
Further details available in Customer Area

Original Advisory
http://www.intruders.org.br/adv0206en.html

Deep Links
Links available in Customer Area