PT-2019-13359 · D Link · D-Link Dir-818Lw

Publicado 2019-07-10 · Atualizado 2021-04-23 · CVE-2019-13481

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-818LW version 2.06betab01

Description A command injection issue was discovered in the HNAP1 protocol, which is exploitable with authentication. This issue occurs via shell metacharacters in the MTU field when using the SetWanSettings function.

Recommendations For D-Link DIR-818LW version 2.06betab01, as a temporary workaround, consider restricting access to the HNAP1 protocol or disabling the SetWanSettings function until a patch is available. Avoid using shell metacharacters in the MTU field to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-13481

Produtos afetados

D-Link Dir-818Lw

Referências · 4

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-3.pdf · Exploit
• http://securityfocus.com/bid/109131 · Nota
• https://osv.dev/vulnerability/CVE-2019-13481 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13481 · Nota de Segurança