EIP-2026-101646

PRE-CVE

D-Link DSL-2750u / DSL-2730u - (Authenticated) Local File Disclosure

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-101646. PoCs published by SATHISH ARTHAR.

AI-analyzed exploit summary This exploit demonstrates an authenticated Local File Inclusion (LFI) vulnerability in D-Link DSL-2750u and DSL-2730u routers. The 'getpage' parameter in the 'webproc' script is exploited to access sensitive files like /etc/passwd and /etc/shadow.

Description

D-Link DSL-2750u / DSL-2730u - (Authenticated) Local File Disclosure

Exploits (1)

exploitdb WORKING POC
by SATHISH ARTHAR · textwebappshardware
https://www.exploit-db.com/exploits/37516

This exploit demonstrates an authenticated Local File Inclusion (LFI) vulnerability in D-Link DSL-2750u and DSL-2730u routers. The 'getpage' parameter in the 'webproc' script is exploited to access sensitive files like /etc/passwd and /etc/shadow.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: D-Link DSL-2750u (firmware: IN_1.08), DSL-2730u (firmware: IN_1.02)
Auth required
Prerequisites: Authenticated session (valid sessionid cookie) · Network access to the router's web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026