PT-2019-13143 · D Link · D-Link Dir-823G

Published 2019-07-01 · Updated 2020-08-24 · CVE-2019-13128

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G version 1.02B03

Description A command injection issue was discovered in the HNAP1 protocol, which is exploitable with authentication. This issue allows for command injection via shell metacharacters in the IPAddress or Gateway field when using the SetStaticRouteSettings function.

Recommendations For D-Link DIR-823G version 1.02B03, as a temporary workaround, consider restricting access to the HNAP1 protocol or avoiding the use of shell metacharacters in the IPAddress or Gateway fields until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-13128

Affected Products

D-Link Dir-823G

References · 4

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/DIR-823G-v2.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13128 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13128 · Vendor Advisory
• https://t.me/malwr/1584 · Telegram Post