PT-2017-3602 · D Link · Dir-868L+3

Kaixiang Zhang · Published 2017-06-08 · Updated 2025-01-27 · CVE-2018-6530

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L versions prior to DIR868LA1 FW112b04 D-Link DIR-865L versions prior to DIR-865L REVA FIRMWARE PATCH 1.08.B01 D-Link DIR-880L versions prior to DIR-880L REVA FIRMWARE PATCH 1.08B04 D-Link DIR-860L versions prior to DIR860LA1 FW110b04

Description: The issue is related to the soapcgi main function in the soap.cgi script (/htdocs/cgibin/soap.cgi) of D-Link router microsoftware, which fails to neutralize special elements used in an operating system command. This allows a remote attacker to execute arbitrary OS commands using the service parameter.

Recommendations: For D-Link DIR-868L versions prior to DIR868LA1 FW112b04, update to a version newer than DIR868LA1 FW112b04. For D-Link DIR-865L versions prior to DIR-865L REVA FIRMWARE PATCH 1.08.B01, update to a version newer than DIR-865L REVA FIRMWARE PATCH 1.08.B01. For D-Link DIR-880L versions prior to DIR-880L REVA FIRMWARE PATCH 1.08B04, update to a version newer than DIR-880L REVA FIRMWARE PATCH 1.08B04. For D-Link DIR-860L versions prior to DIR860LA1 FW110b04, update to a version newer than DIR860LA1 FW110b04. As a temporary workaround, consider restricting access to the vulnerable soap.cgi script until a patch is available. Avoid using the service parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2018-00550

CVE-2018-6530

Affected Products

Dir-860L

Dir-865L

Dir-868L

Dir-880L

References · 16

• 🔥 https://github.com/TheBeeMan/Pwning-multiple-dlink-router-via-SOAP-proto · Exploit
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-865L/REVA/DIR-865L_REVA_FIRMWARE_PATCH_NOTES_1.10B01_EN_WW.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00550 · Security Note
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-880L/REVA/DIR-880L_REVA_FIRMWARE_PATCH_NOTES_1.08B06_EN_WW.pdf · Vendor Advisory
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-860L/REVA/DIR-860L_REVA_FIRMWARE_PATCH_NOTES_1.11B01_EN_WW.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6530 · Security Note
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10105 · Security Note
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-868L/REVA/DIR-868L_REVA_FIRMWARE_PATCH_NOTES_1.20B01_EN_WW.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-6530 · Vendor Advisory
• https://t.me/aptreports/1597 · Telegram Post
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-880L/REVA/DIR-880L_REVA_FIRMWARE_PATCH_NOTES_1.08B06_EN_WW.pdff · Note
• https://t.me/aptreports/1590 · Telegram Post
• https://t.me/true_secator/3387 · Telegram Post
• https://t.me/cvenotify/108710 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note