D-Link DIR-868L HNAP SOAPACTION Pre-Auth OS Command Injection

#!/usr/bin/env bash
# check_dir868l.sh — CVE-2026-110536 exposure checker
# Checks if a target IP is a D-Link DIR-868L running vulnerable firmware.
# Safe: sends only a standard HNAP GetDeviceSettings request.
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <router-ip> [port]"
  echo "Example: $0 192.168.0.1 80"
  exit 2
fi

TARGET="$1"
PORT="${2:-80}"
TIMEOUT=10
URL="http://${TARGET}:${PORT}/HNAP1/"

echo "[*] Probing ${URL} for HNAP endpoint..."

# Send a legitimate HNAP GetDeviceSettings request (no injection)
RESPONSE=$(curl -s -m "$TIMEOUT" \
  -H 'SOAPACTION: "http://purenetworks.com/HNAP1/GetDeviceSettings"' \
  -H 'Content-Type: text/xml' \
  "$URL" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "[?] UNKNOWN — No response from ${TARGET}:${PORT}. Host may be down or HNAP not exposed."
  exit 2
fi

# Check if response contains DIR-868L model identifier
if echo "$RESPONSE" | grep -qi 'DIR-868L'; then
  echo "[!] DIR-868L detected at ${TARGET}:${PORT}"
  
  # Try to extract firmware version
  FW_VER=$(echo "$RESPONSE" | grep -oiP '(?<=<FirmwareVersion>)[^<]+' || true)
  MODEL=$(echo "$RESPONSE" | grep -oiP '(?<=<ModelName>)[^<]+' || true)
  HW_VER=$(echo "$RESPONSE" | grep -oiP '(?<=<HardwareVersion>)[^<]+' || true)
  
  echo "    Model:    ${MODEL:-unknown}"
  echo "    Firmware: ${FW_VER:-unknown}"
  echo "    Hardware: ${HW_VER:-unknown}"
  
  # DIR-868L is EOL with no patches — ALL firmware versions are vulnerable
  echo ""
  echo "[!] VULNERABLE — DIR-868L is End-of-Life (since 2016) with no security patches."
  echo "    CVE-2026-110536: Pre-auth command injection via HNAP SOAPACTION header."
  echo "    ACTION: Replace this device immediately. No firmware fix will ever be released."
  exit 0
else
  # Check if it's a different D-Link model with HNAP
  if echo "$RESPONSE" | grep -qi 'HNAP\|purenetworks'; then
    echo "[*] HNAP endpoint detected but device is NOT a DIR-868L."
    echo "    (Other D-Link models may have separate HNAP vulnerabilities.)"
    echo "[-] PATCHED — Not affected by CVE-2026-110536 (wrong model)."
    exit 1
  else
    echo "[?] UNKNOWN — Response received but no HNAP/DIR-868L signature found."
    exit 2
  fi
fi