PT-2019-13423 · D Link · Dir-655

Published 2019-07-11 · Updated 2019-07-12 · CVE-2019-13562

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 C devices before version 3.02B05 BETA03

Description The issue allows for XSS, as demonstrated by the "/www/ping response.cgi" API endpoint with the ping ipaddr parameter, the "/www/ping6 response.cgi" API endpoint with the ping6 ipaddr parameter, and the "/www/apply sec.cgi" API endpoint with the html response return page parameter.

Recommendations For versions prior to 3.02B05 BETA03, update to version 3.02B05 BETA03 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints "/www/ping response.cgi", "/www/ping6 response.cgi", and "/www/apply sec.cgi" until the update is applied. Avoid using the parameters ping ipaddr, ping6 ipaddr, and html response return page in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13562

Affected Products

Dir-655

References · 5

• 🔥 https://nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13562 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13562 · Vendor Advisory
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_RELEASE_NOTES_v3.02B05_BETA03.pdf · Note
• https://nccgroup.trust/contentassets/7188fe7f130846ffa31827fc1661d120/crosssitescripting.txt · Note