PT-2019-4331 · D Link · Dba-1510P

Goroh_Kun + 1 · Publicado 2019-12-26 · Atualizado 2020-01-07 · CVE-2019-6013

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DBA-1510P firmware version 1.70b009 and earlier

Description The issue allows authenticated attackers to execute arbitrary OS commands via the Command Line Interface (CLI). This is due to the lack of measures to neutralize special elements used in the OS command. Exploitation of the issue may allow a remote attacker to execute arbitrary OS commands.

Recommendations For DBA-1510P firmware version 1.70b009 and earlier, consider disabling access to the Command Line Interface (CLI) until a patch is available. Restrict access to the CLI to minimize the risk of exploitation. Avoid using the CLI for executing OS commands until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2020-00046

CVE-2019-6013

Produtos afetados

Dba-1510P

Referências · 6

• https://dlink-jp.com/product/dba-1510p#product_firmware · Aviso do Fabricante
• https://securitylab.ru/vulnerability/501590.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-6013 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-00046 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6013 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN95875796/index.html · Nota