PT-2018-3917 · D Link · D-Link Dir-615

Sebao · Published 2018-04-26 · Updated 2023-04-26 · CVE-2018-10431

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-615 version 2.5.17

Description The issue is related to the lack of proper sanitization of special elements used in an operating system command, allowing remote code execution. This can be exploited by an attacker to execute arbitrary code remotely. The vulnerability is specifically related to the use of shell metacharacters in the Host field of the System / Traceroute screen.

Recommendations For D-Link DIR-615 version 2.5.17, consider restricting access to the System / Traceroute screen to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using shell metacharacters in the Host field. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-03073

CVE-2018-10431

Affected Products

D-Link Dir-615

References · 4

• 🔥 https://github.com/imsebao/404team/blob/master/dlink/dlink_dir615_rce.md · Exploit
• https://bdu.fstec.ru/vul/2023-03073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10431 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10431 · Vendor Advisory