PT-2019-13143 · D Link · D-Link Dir-823G

Publicado 2019-07-01 · Atualizado 2020-08-24 · CVE-2019-13128

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G version 1.02B03

Description A command injection issue was discovered in the HNAP1 protocol, which is exploitable with authentication. This issue allows for command injection via shell metacharacters in the IPAddress or Gateway field when using the SetStaticRouteSettings function.

Recommendations For D-Link DIR-823G version 1.02B03, as a temporary workaround, consider restricting access to the HNAP1 protocol or avoiding the use of shell metacharacters in the IPAddress or Gateway fields until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-13128

Produtos afetados

D-Link Dir-823G

Referências · 4

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/DIR-823G-v2.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13128 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13128 · Aviso do Fabricante
• https://t.me/malwr/1584 · Publicação no Telegram