PT-2013-1000 · D Link · Dsr-250+6

0_O

·

Published

2013-08-18

·

Updated

2023-04-26

·

CVE-2013-5946

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions D-Link DSR-1000 versions prior to firmware 1.08B77 D-Link DSR-1000N versions prior to firmware 1.08B77 D-Link DSR-150 versions prior to firmware 1.08B44 D-Link DSR-150N versions prior to firmware 1.05B64 D-Link DSR-250 versions prior to firmware 1.08B44 D-Link DSR-250N versions prior to firmware 1.08B44 D-Link DSR-500 versions prior to firmware 1.08B77 D-Link DSR-500N versions prior to firmware 1.08B77
Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the "Ping or Trace an IP Address" or "Perform a DNS Lookup" section. This is due to the lack of proper filtering of user input in the /scgi-bin/platform.cgi script, specifically in the Password field, which enables an attacker to bypass authentication and gain access to the device with administrator privileges.
Recommendations For D-Link DSR-1000 and DSR-1000N, update to firmware version 1.08B77 or later. For D-Link DSR-150, update to firmware version 1.08B44 or later. For D-Link DSR-150N, update to firmware version 1.05B64 or later. For D-Link DSR-250 and DSR-250N, update to firmware version 1.08B44 or later. For D-Link DSR-500 and DSR-500N, update to firmware version 1.08B77 or later. As a temporary workaround, consider restricting access to the /scgi-bin/platform.cgi script to minimize the risk of exploitation. Avoid using the Password field in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78CWE-592

Related Identifiers

BDU:2014-00002
BDU:2015-00091
BDU:2015-00092
BDU:2015-00093
BDU:2015-10244
CVE-2013-5946

Affected Products

Dsr-1000
Dsr-1000N
Dsr-150
Dsr-250
Dsr-250N
Dsr-500
Dsr-500N