PT-2019-2559 · D Link · Dir-818Lw

Publicado 2019-06-05 · Atualizado 2021-07-21 · CVE-2019-12787

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-818LW versions 2.05.B03 through 2.06B01 BETA

Description The issue is related to errors in processing XML requests, which can allow a remote attacker to execute arbitrary commands. Specifically, there is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the Gateway key.

Recommendations For versions 2.05.B03 through 2.06B01 BETA, consider restricting access to the HNAP1 SetWanSettings API endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the Gateway key in XML requests to the affected endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-91

CWE-78

Identificadores relacionados

BDU:2019-02411

CVE-2019-12787

Produtos afetados

Dir-818Lw

Referências · 5

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-2-protected.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12787 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-02411 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12787 · Aviso do Fabricante
• https://cxsecurity.com/cveshow/CVE-2019-12787 · Nota