D-Link DSL-2740B ADSL Router - Authentication Bypass

+------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title      : D-Link DSL-2740B (ADSL Router) Authentication Bypass
# Date               : 10-02-2013
# Author             : Ivano Binetti (http://ivanobinetti.com)
# Vendor site        : http://www.d-link.com
# Version            : DSL-2740B
# Tested on          : Firmware Version: EU_1.0 (other models/firmware could be also affected)
# Original Advisory  : http://www.webapp-security.com/2013/03/d-link-dsl-2740b-adsl-router-authentication-bypass/
# CVE                : CVE-2013-2271
+-------------------------------------------------------------------------------------------------------------------------------------------+
+---------------------------------------[D-Link DSL-2740B Bypass Authentication by Ivano Binetti]-------------------------------------------+
Summary
 
1)Introduction
2)Vulnerability Description
3)Exploit
+--------------------------------------------------------------------------------------------------------------------------------------------+ 

1)Introduction
D-Link DSL-2740B is an ADSL Router using a web management interface in order to change configuration settings.
 
2)Vulnerability Description
This router allows an attacker to bypass authentication and to login with administrator ("admin" user) permissions.
When the administrator is logged in the web management interface, an attacker is be able to completely bypass authentication phase and 
connect to the web management interface with administrator's credentials.
Please observe that the default URL to access to the web management interface is "http://192.168.1.1" but this attack can also be 
performed by an axternal attacker who connects to the router's public IP address, if remote management is enabled.
  
3)Exploit
When an administrator in logged in the web management interface an attacker can bypass authentication and get administrator permissions
connecting to the following URL:

http://<ip address>/login.cgi (where <ip address> can be both internal or public)