PT-2019-13359 · D Link · D-Link Dir-818Lw

Published 2019-07-10 · Updated 2021-04-23 · CVE-2019-13481

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-818LW version 2.06betab01

Description A command injection issue was discovered in the HNAP1 protocol, which is exploitable with authentication. This issue occurs via shell metacharacters in the MTU field when using the SetWanSettings function.

Recommendations For D-Link DIR-818LW version 2.06betab01, as a temporary workaround, consider restricting access to the HNAP1 protocol or disabling the SetWanSettings function until a patch is available. Avoid using shell metacharacters in the MTU field to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-13481

Affected Products

D-Link Dir-818Lw

References · 4

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-3.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2019-13481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13481 · Security Note
• http://securityfocus.com/bid/109131 · Note