PT-2019-14247 · D Link · D-Link Dir-823G

Publicado 2019-08-23 · Atualizado 2020-08-24 · CVE-2019-15527

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G version V1.0.2B05

Description A command injection issue was discovered in the HNAP1 protocol, which is exploitable with authentication. This issue occurs due to shell metacharacters in the MaxIdTime field when using the SetWanSettings function.

Recommendations For D-Link DIR-823G version V1.0.2B05, consider restricting access to the HNAP1 protocol until a patch is available. As a temporary workaround, avoid using shell metacharacters in the MaxIdTime field to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-15527

Produtos afetados

D-Link Dir-823G

Referências · 3

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-6.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2019-15527 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15527 · Nota de Segurança