PT-2019-3258 · D Link · D-Link Dir-823G

Publicado 2019-08-23 · Atualizado 2020-08-24 · CVE-2019-15530

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G version V1.0.2B05

Description The issue is related to the lack of data sanitization on the management level of the D-Link DIR-823G router's firmware. This can be exploited by a remote attacker to elevate privileges and execute arbitrary commands by sending a request to the "/HNAP1" endpoint, potentially using shell metacharacters in the LoginPassword field.

Recommendations For D-Link DIR-823G version V1.0.2B05, consider disabling access to the "/HNAP1" endpoint until a patch is available to prevent command injection attacks. Restrict the use of the LoginPassword field to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2019-03249

CVE-2019-15530

Produtos afetados

D-Link Dir-823G

Referências · 6

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-2.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2019-15530 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15530 · Nota de Segurança
• https://cxsecurity.com/cveshow/CVE-2019-15530 · Nota
• https://bdu.fstec.ru/vul/2019-03249 · Nota de Segurança
• https://vuldb.com/de/?id.140745 · Nota