PT-2018-3904 · D Link · D-Link Dir-620

Denis Makrushin · Published 2018-05-23 · Updated 2023-04-26 · CVE-2018-6211

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-620 versions 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22

Description The issue is related to incorrect processing of the res buf parameter to "index.cgi", allowing OS command injection. This can be exploited by a remote attacker to execute arbitrary commands. The vulnerability is due to the failure to neutralize special elements used in the operating system command.

Recommendations For D-Link DIR-620 devices with the affected firmware versions, consider disabling access to the "index.cgi" endpoint until a patch is available. Avoid using the res buf parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-03055

CVE-2018-6211

Affected Products

D-Link Dir-620

References · 7

• 🔥 https://securelist.com/backdoors-in-d-links-backyard/85530 · Exploit
• https://bdu.fstec.ru/vul/2023-03055 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6211 · Security Note
• https://securityaffairs.co/wordpress/72839/hacking/d-link-dir-620-flaws.html · Note
• https://bleepingcomputer.com/news/security/backdoor-account-found-in-d-link-dir-620-routers · Note
• http://securitynewspaper.com/2018/05/25/d-link-dir-620-routers-critical-vulnerabilities · Note