PT-2018-2191 · D Link · D-Link Central Wifimanager Cwm-100

Hyp3Rlinx + 1 · Published 2018-08-08 · Updated 2023-04-26 · CVE-2018-15517

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions D-Link Central WiFiManager CWM-100 version 1.03 r0098

Description The issue concerns the MailConnect feature, which is supposed to check connections to an SMTP server but actually allows outbound TCP to any port on any IP address. This leads to a Server-Side Request Forgery (SSRF) vulnerability, as demonstrated by a specific URI, "index.php/System/MailConnect/host/127.0.0.1/port/22/secure/". The vulnerability exists due to insufficient validation of incoming requests, potentially allowing a remote attacker to perform an SSRF attack.

Recommendations For D-Link Central WiFiManager CWM-100 version 1.03 r0098, consider disabling the MailConnect feature until a patch is available to prevent potential SSRF attacks. Restrict access to the MailConnect functionality to minimize the risk of exploitation. Avoid using the MailConnect feature with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2019-00169

CVE-2018-15517

Affected Products

D-Link Central Wifimanager Cwm-100

References · 7

• 🔥 http://packetstormsecurity.com/files/150243/D-LINK-Central-WifiManager-CWM-100-1.03-r0098-Server-Side-Request-Forgery.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Nov/28 · Exploit
• https://osv.dev/vulnerability/CVE-2018-15517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15517 · Security Note
• https://bdu.fstec.ru/vul/2019-00169 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/152844 · Note
• https://cxsecurity.com/issue/WLB-2018110068 · Note