PT-2019-13423 · D Link · Dir-655

Publicado 2019-07-11 · Atualizado 2019-07-12 · CVE-2019-13562

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 C devices before version 3.02B05 BETA03

Description The issue allows for XSS, as demonstrated by the "/www/ping response.cgi" API endpoint with the ping ipaddr parameter, the "/www/ping6 response.cgi" API endpoint with the ping6 ipaddr parameter, and the "/www/apply sec.cgi" API endpoint with the html response return page parameter.

Recommendations For versions prior to 3.02B05 BETA03, update to version 3.02B05 BETA03 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints "/www/ping response.cgi", "/www/ping6 response.cgi", and "/www/apply sec.cgi" until the update is applied. Avoid using the parameters ping ipaddr, ping6 ipaddr, and html response return page in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13562

Produtos afetados

Dir-655

Referências · 5

• 🔥 https://nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13562 · Nota de Segurança
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_RELEASE_NOTES_v3.02B05_BETA03.pdf · Nota
• https://nccgroup.trust/contentassets/7188fe7f130846ffa31827fc1661d120/crosssitescripting.txt · Nota
• https://osv.dev/vulnerability/CVE-2019-13562 · Aviso do Fabricante