PT-2019-3088 · D Link · Dcs-934L+9

Published 2019-05-06 · Updated 2020-08-24 · CVE-2019-10999

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS series versions 1.08.11 and below (DCS-5009L) D-Link DCS series versions 1.14.09 and below (DCS-5010L) D-Link DCS series versions 1.15.12 and below (DCS-5020L) D-Link DCS series versions 1.03.07 and below (DCS-5025L) D-Link DCS series versions 1.04.10 and below (DCS-5030L) D-Link DCS series versions 2.16.01 and below (DCS-930L) D-Link DCS series versions 1.14.11 and below (DCS-931L) D-Link DCS series versions 2.17.01 and below (DCS-932L) D-Link DCS series versions 1.14.11 and below (DCS-933L) D-Link DCS series versions 1.05.04 and below (DCS-934L)

Description The issue is caused by a stack-based buffer overflow in the alphapd component of the D-Link DCS series Wi-Fi cameras' web server. This allows a remotely authenticated attacker to execute arbitrary code by providing a long string in the WEPEncryption parameter when requesting "wireless.htm".

Recommendations For DCS-5009L version 1.08.11 and below, update to a version above 1.08.11. For DCS-5010L version 1.14.09 and below, update to a version above 1.14.09. For DCS-5020L version 1.15.12 and below, update to a version above 1.15.12. For DCS-5025L version 1.03.07 and below, update to a version above 1.03.07. For DCS-5030L version 1.04.10 and below, update to a version above 1.04.10. For DCS-930L version 2.16.01 and below, update to a version above 2.16.01. For DCS-931L version 1.14.11 and below, update to a version above 1.14.11. For DCS-932L version 2.17.01 and below, update to a version above 2.17.01. For DCS-933L version 1.14.11 and below, update to a version above 1.14.11. For DCS-934L version 1.05.04 and below, update to a version above 1.05.04. As a temporary workaround, consider restricting access to the alphapd component until a patch is available. Avoid using the WEPEncryption parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2019-03071

CVE-2019-10999

Affected Products

Dcs-5009L

Dcs-5010L

Dcs-5020L

Dcs-5025L

Dcs-5030L

Dcs-930L

Dcs-931L

Dcs-932L

Dcs-933L

Dcs-934L

References · 8

• 🔥 https://github.com/fuzzywalls/CVE-2019-10999 · Exploit
• 🔥 https://github.com/tacnetsol/CVE-2019-10999 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10999 · Security Note
• https://bdu.fstec.ru/vul/2019-03071 · Security Note
• https://cxsecurity.com/cveshow/CVE-2019-10999 · Note
• https://cvedetails.com/cve/CVE-2019-10999 · Note
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10131 · Note