PT-2016-3444 · D Link · Dcs-930L

Published 2016-02-10 · Updated 2025-02-04 · CVE-2016-11021

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-930L devices version 2.12 and earlier

Description The issue allows a remote attacker to execute code via an OS command in the SystemCommand parameter. This is due to the lack of measures to neutralize special elements used in the OS command. Exploitation of the issue can allow a remote attacker to execute arbitrary commands.

Recommendations For D-Link DCS-930L devices version 2.12 and earlier, update to version 2.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the setSystemCommand function until a patch is available. Avoid using the SystemCommand parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-01044

CVE-2016-11021

Affected Products

Dcs-930L

References · 10

• 🔥 https://exploit-db.com/exploits/39437 · Exploit
• https://bdu.fstec.ru/vul/2023-01044 · Security Note
• https://osv.dev/vulnerability/CVE-2016-11021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-11021 · Security Note
• https://t.me/cvenotify/108752 · Telegram Post
• https://anti-malware.ru/news/2021-11-15-114534/37472 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-11021 · Note
• https://t.me/cibsecurity/10362 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/109988 · Telegram Post