PT-2019-3098 · D Link · D-Link Dir-825Ac G1

Published 2019-08-27 · Updated 2023-04-27 · CVE-2019-13263

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-825AC G1 devices (affected versions not specified)

Description The issue exists due to insufficient input validation in the D-Link router firmware, allowing a remote attacker to bypass compartmentalization between the host network and the guest network using the DHCP protocol. Specifically, when a DHCP Request is sent to the router with a certain Transaction ID field, the router responds with an ACK or NAK message. In the case of a NAK response, the router erroneously sends the NAK to both the host and guest networks with the same Transaction ID, potentially allowing data to be encoded and sent across the router.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Improper Privilege Management

Weakness Enumeration

CWE-20

CWE-669

CWE-269

Related Identifiers

BDU:2019-03081

CVE-2019-13263

Affected Products

D-Link Dir-825Ac G1

References · 5

• 🔥 https://orenlab.sise.bgu.ac.il/publications/CrossRouter · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13263 · Security Note
• https://bdu.fstec.ru/vul/2019-03081 · Security Note
• https://usenix.org/system/files/woot19-paper_ovadia.pdf · Note
• https://cxsecurity.com/cveshow/CVE-2019-13263 · Note