PT-2018-3904 · D Link · D-Link Dir-620

Denis Makrushin · Publicado 2018-05-23 · Atualizado 2023-04-26 · CVE-2018-6211

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-620 versions 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22

Description The issue is related to incorrect processing of the res buf parameter to "index.cgi", allowing OS command injection. This can be exploited by a remote attacker to execute arbitrary commands. The vulnerability is due to the failure to neutralize special elements used in the operating system command.

Recommendations For D-Link DIR-620 devices with the affected firmware versions, consider disabling access to the "index.cgi" endpoint until a patch is available. Avoid using the res buf parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-03055

CVE-2018-6211

Produtos afetados

D-Link Dir-620

Referências · 7

• 🔥 https://securelist.com/backdoors-in-d-links-backyard/85530 · Exploit
• https://bdu.fstec.ru/vul/2023-03055 · Nota de Segurança
• https://securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html · Nota
• https://bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers · Nota
• https://osv.dev/vulnerability/CVE-2018-6211 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6211 · Nota de Segurança
• http://securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities · Nota