PT-2019-3736 · D Link · Dir-823

Publicado 2019-08-23 · Atualizado 2020-08-24 · CVE-2019-15528

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G versions V1.0.2B05

Description The issue is related to the lack of input validation in the SetStaticRouteSettings field, allowing for command injection via shell metacharacters in the Interface field. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information by sending a request to the "HNAP1" endpoint.

Recommendations For version V1.0.2B05, consider restricting access to the "HNAP1" endpoint and the SetStaticRouteSettings field to minimize the risk of exploitation. As a temporary workaround, avoid using shell metacharacters in the Interface field until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

BDU:2019-03991

CVE-2019-15528

Produtos afetados

Dir-823

Referências · 5

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-5.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2019-15528 · Aviso do Fabricante
• https://cxsecurity.com/cveshow/CVE-2019-15528 · Nota
• https://bdu.fstec.ru/vul/2019-03991 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-15528 · Nota de Segurança