PT-2019-1345 · D Link · D-Link Dir-823G

David Chen · Publicado 2019-01-31 · Atualizado 2023-04-26 · CVE-2019-7297

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G devices with firmware through 1.02B03

Description An issue allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system function with an untrusted input parameter named Address. Consequently, an attacker can execute any command remotely when they control this input. The vulnerability is related to insufficient input data cleaning used in commands.

Recommendations For D-Link DIR-823G devices with firmware through 1.02B03, consider disabling the GetNetworkTomographyResult function until a patch is available to prevent exploitation via the /HNAP1 request. Restrict access to the Address input parameter to minimize the risk of arbitrary command execution.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2019-00683

CVE-2019-7297

Produtos afetados

D-Link Dir-823G

Referências · 7

• 🔥 https://github.com/leonW7/D-Link/blob/master/Vul_1.md · Exploit
• https://cxsecurity.com/cveshow/CVE-2019-7297 · Nota
• https://osv.dev/vulnerability/CVE-2019-7297 · Aviso do Fabricante
• http://securityfocus.com/bid/106815 · Nota
• https://bdu.fstec.ru/vul/2019-00683 · Nota de Segurança
• https://vuldb.com/?id.130380 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-7297 · Nota de Segurança