PT-2018-4011 · D Link · D-Link Dsl-3782

Adam Simuntis + 1 · Published 2018-04-03 · Updated 2023-04-26 · CVE-2018-8941

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version EU v. 1.01

Description The issue concerns a buffer overflow in the diagnostics functionality of the affected device. This allows authenticated remote attackers to execute arbitrary code by sending a long Addr value to the set Diagnostics Entry function in an HTTP request. The vulnerability is related to the /userfs/bin/tcapi endpoint.

Recommendations For D-Link DSL-3782 version EU v. 1.01, consider disabling the set Diagnostics Entry function as a temporary workaround until a patch is available. Restrict access to the /userfs/bin/tcapi endpoint to minimize the risk of exploitation. Avoid using long Addr values in HTTP requests to the affected function until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2024-09648

CVE-2018-8941

Affected Products

D-Link Dsl-3782

References · 4

• 🔥 https://github.com/SECFORCE/CVE-2018-8941 · Exploit
• https://osv.dev/vulnerability/CVE-2018-8941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8941 · Security Note
• https://bdu.fstec.ru/vul/2024-09648 · Security Note