D-Link DIR-505 Web Management CGI hidden maintenance backdoor via secmark1524.cgi

#!/usr/bin/env bash
# check_dir505_cve2026118579.sh
# Checks whether a host is a D-Link DIR-505 running vulnerable firmware 1.10B02
# Does NOT trigger the backdoor — only fingerprints the device.
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/NOT-AFFECTED, 2 = UNKNOWN

set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <target-ip>"
  exit 2
fi

TARGET="$1"
TIMEOUT=5

echo "[*] Probing http://${TARGET}/ for D-Link DIR-505 fingerprint..."

# Grab the main page and headers
RESPONSE=$(curl -sk --max-time "$TIMEOUT" -D - "http://${TARGET}/" 2>/dev/null) || {
  echo "[!] Could not connect to http://${TARGET}/"
  echo "UNKNOWN"
  exit 2
}

# Check for DIR-505 in response body or headers
if echo "$RESPONSE" | grep -qi 'DIR-505'; then
  echo "[+] Device identifies as DIR-505"
else
  echo "[-] Device does not appear to be a DIR-505"
  echo "PATCHED"
  exit 1
fi

# Try to extract firmware version from common D-Link status pages
for PATH_CHECK in "/Status/wan_info.asp" "/info_firmware.asp" "/status.htm" "/" ; do
  PAGE=$(curl -sk --max-time "$TIMEOUT" "http://${TARGET}${PATH_CHECK}" 2>/dev/null) || continue
  if echo "$PAGE" | grep -qoE '1\.10B02'; then
    echo "[!] Firmware version 1.10B02 detected — VULNERABLE to CVE-2026-118579"
    echo "VULNERABLE"
    exit 0
  fi
  if echo "$PAGE" | grep -qoE '1\.06'; then
    echo "[-] Firmware version 1.06 detected — NOT affected per researcher binary diff"
    echo "PATCHED"
    exit 1
  fi
done

# Check if the backdoor CGI endpoint exists (HEAD request only, does not trigger)
HTTP_CODE=$(curl -sk --max-time "$TIMEOUT" -o /dev/null -w '%{http_code}' -I "http://${TARGET}/secmark1524.cgi" 2>/dev/null) || HTTP_CODE="000"
if [[ "$HTTP_CODE" == "200" || "$HTTP_CODE" == "405" ]]; then
  echo "[!] Backdoor CGI endpoint /secmark1524.cgi responds (HTTP $HTTP_CODE) — likely VULNERABLE"
  echo "VULNERABLE"
  exit 0
elif [[ "$HTTP_CODE" == "404" ]]; then
  echo "[-] Backdoor CGI endpoint not found (HTTP 404) — likely not affected"
  echo "PATCHED"
  exit 1
fi

echo "[?] DIR-505 detected but could not confirm firmware version or backdoor endpoint"
echo "UNKNOWN"
exit 2