PT-2019-4069 · D Link · D-Link Dir-859+1

Dahua966 · Published 2019-10-11 · Updated 2019-10-16 · CVE-2019-17508

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-859 versions A3 D-Link DIR-850L version A1.13

Description The issue is related to the etc/services/DEVICE.TIME.php component of the D-Link DIR-859 A3 and D-Link DIR-850L A microprogrammed software for wireless routers. It is associated with the failure to neutralize special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to execute arbitrary code using the $ SERVER array. The /etc/services/DEVICE.TIME.php file allows command injection via the $SERVER variable.

Recommendations For D-Link DIR-859 version A3, consider disabling the DEVICE.TIME.php component until a patch is available. For D-Link DIR-850L version A1.13, restrict access to the /etc/services/DEVICE.TIME.php file to minimize the risk of exploitation. Avoid using the $ SERVER variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-04630

CVE-2019-17508

Affected Products

D-Link Dir-850L

D-Link Dir-859

References · 7

• 🔥 https://github.com/dahua966/Routers-vuls/tree/master/DIR-859 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17508 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17508 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04630 · Security Note
• https://support.dlink.com/ProductInfo.aspx?m=DIR-850L · Note
• https://support.dlink.com/ProductInfo.aspx?m=DIR-859 · Note
• https://cxsecurity.com/cveshow/CVE-2019-17508 · Note