PT-2019-8631 · D Link · D-Link Dcs-1130

Mandar Satam · Publicado 2019-07-02 · Atualizado 2023-04-26 · CVE-2017-8408

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-1130 devices (affected versions not specified)

Description An issue was discovered on D-Link DCS-1130 devices, where the device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. The GET parameters passed in this request result in being passed as commands to a "system" API in the function, thus resulting in command injection on the device. The binary "cgibox" contains the vulnerable function "sub 7EAFC" that receives the values sent by the GET request. The value set in GET parameter user is extracted in function sub 7E49C which is then passed to the vulnerable system API call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2017-8408

Produtos afetados

D-Link Dcs-1130

Referências · 5

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8408 · Nota de Segurança
• https://t.me/cibsecurity/5388 · Publicação no Telegram
• https://seclists.org/bugtraq/2019/Jun/8 · Nota
• https://t.me/cibsecurity/5296 · Publicação no Telegram