PT-2023-5897 · D Link · D-Link Dir-2150+1
Evan Qi
+2
·
Publicado
2023-10-04
·
Atualizado
2025-03-24
·
CVE-2023-44415
CVSS v3.1
8.0
Alta
| Vetor | AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
D-Link DIR-1260 and DIR-2150 routers (affected versions not specified)
Description
This issue allows network-adjacent attackers to execute arbitrary code on affected installations. The flaw exists within the CLI service, which listens on TCP port 23, due to the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Authentication is required to exploit this issue.
Recommendations
For D-Link DIR-1260 and DIR-2150 routers, consider disabling the CLI service until a patch is available.
Restrict access to TCP port 23 to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this issue.
Correção
RCE
OS Command Injection
Improper Neutralization
Command Injection
Special Elements Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
D-Link Dir-1260
D-Link Dir-2150