PT-2015-3362 · D Link · Dir-815

Published 2015-08-10 · Updated 2023-04-26 · CVE-2014-8888

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-815 versions prior to 2.03.B02

Description The issue is related to insufficient input validation in the remote administration interface, allowing remote attackers to execute arbitrary commands via specially crafted HTTP requests. This can be achieved through vectors related to an HTTP command injection issue.

Recommendations For versions prior to 2.03.B02, update the firmware to version 2.03.B02 or later to resolve the issue. As a temporary workaround, consider restricting access to the remote administration interface until the update is applied.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2018-00780

CVE-2014-8888

Affected Products

Dir-815

References · 4

• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-815/REVB/DIR-815_REVB_FIRMWARE_PATCH_NOTES_2.03.B02_EN.PDF · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00780 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8888 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/110755 · Note