PT-2019-2519 · D Link · D-Link Dsl-3782

Lorenzo Comi · Published 2019-04-01 · Updated 2019-04-02 · CVE-2018-17990

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version 1.01

Description The issue is related to insufficient argument validation in the Acl.asp component of the D-Link DSL-3782 router's microprogram, which can be exploited by a remote attacker to execute arbitrary commands using the ScrIPaddrEndTXT parameter. This can allow the attacker to perform unauthorized actions.

Recommendations For version 1.01, consider restricting access to the Acl.asp component until a patch is available. As a temporary workaround, avoid using the ScrIPaddrEndTXT parameter in the affected CLI commands to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-02362

CVE-2018-17990

Affected Products

D-Link Dsl-3782

References · 5

• 🔥 https://c0mix.github.io/2019/D-Link-DIR-3782-SecAdvisory-OS-Command-Injection-and-Stored-XSS · Exploit
• https://bdu.fstec.ru/vul/2019-02362 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-17990 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17990 · Vendor Advisory
• https://cxsecurity.com/cveshow/CVE-2018-17990 · Note