CVE-2026-2056: D-Link DIR-605L Information Disclosure Flaw

CVE-2026-2056 is an information disclosure vulnerability in D-Link DIR-605L firmware affecting the DHCP Connection Status Handler. Attackers can remotely exploit this flaw to access sensitive data. This article covers technical details, affected versions, impact assessment, and available mitigations.

CVE-2026-2056 Overview

CVE-2026-2056 is an information disclosure vulnerability affecting D-Link DIR-605L and DIR-619L routers running firmware versions 2.06B01 and 2.13B01. The flaw resides in an unknown function within the /wan_connection_status.asp file, which is part of the DHCP Connection Status Handler component. Remote attackers can trigger the vulnerability over the network without authentication or user interaction. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic abuse. Both affected device families are end-of-life and will not receive a vendor patch from D-Link.

Critical Impact
Unauthenticated remote attackers can extract sensitive DHCP connection status information from affected D-Link routers, enabling reconnaissance of internal network topology and connected clients.

Affected Products

D-Link DIR-605L firmware 2.06B01
D-Link DIR-619L firmware 2.13B01
Both product lines are no longer supported by D-Link

Discovery Timeline

2026-02-06 - CVE-2026-2056 published to NVD
2026-02-17 - Last updated in NVD database

Technical Details for CVE-2026-2056

Vulnerability Analysis

The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The flaw exists in the request handler that serves the /wan_connection_status.asp endpoint on the router's embedded web interface. This page is part of the DHCP Connection Status Handler, which exposes internal state about WAN connectivity and DHCP lease information.

The handler does not enforce proper access controls or session validation before returning data. An attacker who can reach the router's web management interface can request the page directly and receive sensitive operational information. Because the vulnerability is network-reachable and requires no privileges or user interaction, automated scanners can identify and harvest data from vulnerable devices at scale.

Root Cause

The root cause is missing authorization on a status endpoint that should be restricted to authenticated administrators. The DHCP Connection Status Handler returns response data regardless of the requester's authentication state. This design flaw is common in legacy SOHO router firmware where status pages were assumed to be accessed only from the LAN side, but the same handler can be reached if the management interface is exposed to the WAN.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP request to /wan_connection_status.asp on a reachable D-Link DIR-605L or DIR-619L device. The router responds with DHCP and WAN connection status content without challenging the requester. Refer to the GitHub PoC Repository and GitHub Vulnerability Documentation for technical reproduction steps. No verified exploit code is reproduced here.

Detection Methods for CVE-2026-2056

Indicators of Compromise

Unexpected HTTP GET requests targeting /wan_connection_status.asp on D-Link router management interfaces
Requests to the router web interface originating from external IP addresses when remote management should be disabled
Repeated unauthenticated requests to DHCP or WAN status pages from a single source

Detection Strategies

Inspect web server and firewall logs on D-Link DIR-605L and DIR-619L devices for access patterns to /wan_connection_status.asp without a prior authenticated session
Use network intrusion detection signatures that flag HTTP requests to known D-Link status endpoints originating from untrusted networks
Correlate scanning activity targeting common SOHO router management ports (TCP 80, 8080, 443) with subsequent requests to the affected URI

Monitoring Recommendations

Monitor egress and ingress traffic to and from any legacy D-Link routers still in production environments
Alert on any inbound connection attempts to router management ports from the WAN side
Track DNS and HTTP telemetry for reconnaissance patterns indicating enumeration of router status pages

How to Mitigate CVE-2026-2056

Immediate Actions Required

Replace affected D-Link DIR-605L and DIR-619L devices with supported hardware, since both product lines are end-of-life and will not receive a vendor patch
Disable remote management on the WAN interface to prevent unauthenticated external access to the web interface
Restrict LAN-side access to the router management interface using network segmentation and access control lists
Audit firewall rules to confirm that TCP 80, 8080, and 443 are not forwarded to the router from untrusted networks

Patch Information

No official patch is available. D-Link has confirmed that the DIR-605L and DIR-619L are no longer supported by the maintainer. Asset owners must plan device replacement as the primary remediation path. Consult the D-Link Official Website for end-of-life guidance and replacement product recommendations.

Workarounds

Place affected routers behind an upstream firewall that blocks inbound HTTP traffic to the management interface
Disable WAN-side HTTP and HTTPS management services entirely if the device must remain in service
Isolate legacy routers on dedicated VLANs with strict egress filtering to limit reconnaissance value of any disclosed data
Rotate any credentials, network identifiers, or DHCP-related configuration that may have been exposed through prior unauthenticated access

bash

# Example upstream firewall rule to block external access to router management
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 8080 -j DROP