PT-2018-4011 · D Link · D-Link Dsl-3782

Adam Simuntis + 1 · Publicado 2018-04-03 · Atualizado 2023-04-26 · CVE-2018-8941

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version EU v. 1.01

Description The issue concerns a buffer overflow in the diagnostics functionality of the affected device. This allows authenticated remote attackers to execute arbitrary code by sending a long Addr value to the set Diagnostics Entry function in an HTTP request. The vulnerability is related to the /userfs/bin/tcapi endpoint.

Recommendations For D-Link DSL-3782 version EU v. 1.01, consider disabling the set Diagnostics Entry function as a temporary workaround until a patch is available. Restrict access to the /userfs/bin/tcapi endpoint to minimize the risk of exploitation. Avoid using long Addr values in HTTP requests to the affected function until the issue is resolved.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2024-09648

CVE-2018-8941

Produtos afetados

D-Link Dsl-3782

Referências · 4

• 🔥 https://github.com/SECFORCE/CVE-2018-8941 · Exploit
• https://osv.dev/vulnerability/CVE-2018-8941 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8941 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-09648 · Nota de Segurança