PT-2011-1899 · D Link · Dcs-2121

Eren Türkay · Publicado 2011-10-16 · Atualizado 2012-05-14 · CVE-2010-4964

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-2121 camera version 1.04

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the Password field, related to a semicolon injection. This occurs in the recorder test.cgi file.

Recommendations For version 1.04, consider restricting access to the recorder test.cgi file until a patch is available. As a temporary workaround, avoid using shell metacharacters in the Password field to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-4964

Produtos afetados

Dcs-2121

Referências · 4

• 🔥 http://newsoft-tech.blogspot.com/2010/09/d-link-dcs-2121-and-state-of-embedded.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/09/10/1 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/09/14/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4964 · Nota de Segurança