PT-2018-4009 · D Link · D-Link Dsl-2540U+1

Published 2018-01-12 · Updated 2024-02-14 · CVE-2018-5371

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DSL-2640U versions IM 1.00 and ME 1.00 D-Link DSL-2540U version ME 1.00

Description The issue allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request. This is due to the lack of measures to neutralize special elements used in the operating system command.

Recommendations For D-Link DSL-2640U devices with firmware IM 1.00 and ME 1.00, consider restricting access to the diag ping.cmd until a patch is available. For D-Link DSL-2540U devices with firmware ME 1.00, avoid using the ipaddr field in the affected HTTP GET request until the issue is resolved. As a temporary workaround, consider disabling the execution of arbitrary OS commands via shell metacharacters in the ipaddr field until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-09633

CVE-2018-5371

Affected Products

D-Link Dsl-2540U

D-Link Dsl-2640B

References · 6

• 🔥 https://iplantom.com/2018/01/10/dsl2640U · Exploit
• https://bdu.fstec.ru/vul/2024-09633 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-5371 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5371 · Vendor Advisory
• https://clouddefense.ai/cve/2018/CVE-2018-5371 · Note
• https://vuldb.com/?id.111836 · Note