PT-2011-1899 · D Link · Dcs-2121

Eren Türkay · Published 2011-10-16 · Updated 2012-05-14 · CVE-2010-4964

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-2121 camera version 1.04

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the Password field, related to a semicolon injection. This occurs in the recorder test.cgi file.

Recommendations For version 1.04, consider restricting access to the recorder test.cgi file until a patch is available. As a temporary workaround, avoid using shell metacharacters in the Password field to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-4964

Affected Products

Dcs-2121

References · 4

• 🔥 http://newsoft-tech.blogspot.com/2010/09/d-link-dcs-2121-and-state-of-embedded.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/09/10/1 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/09/14/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4964 · Security Note