CVE-2022-36785

D-Link  G integrated Access Device4 Information Disclosure & Authorization Bypass.
*Information Disclosure  
file contains a URL with private IP at line 15 "login.asp" A. The
window.location.href = http://192.168.1.1/setupWizard.asp" http://192.168.1.1/setupWizard.asp" ;
"admin"  contains default username value "login.asp" B. While accessing the web interface, the login form at 

*Authorization Bypass  
URL by "setupWizard.asp' while it blocks direct access to  the web interface does not properly validate user identity variables values located at the client side, it is available to access it without a "login_glag" and "login_status" checking browser and to read the admin user credentials for the web interface.