PT-2019-4331 · D Link · Dba-1510P

Goroh_Kun + 1 · Published 2019-12-26 · Updated 2020-01-07 · CVE-2019-6013

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DBA-1510P firmware version 1.70b009 and earlier

Description The issue allows authenticated attackers to execute arbitrary OS commands via the Command Line Interface (CLI). This is due to the lack of measures to neutralize special elements used in the OS command. Exploitation of the issue may allow a remote attacker to execute arbitrary OS commands.

Recommendations For DBA-1510P firmware version 1.70b009 and earlier, consider disabling access to the Command Line Interface (CLI) until a patch is available. Restrict access to the CLI to minimize the risk of exploitation. Avoid using the CLI for executing OS commands until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-00046

CVE-2019-6013

Affected Products

Dba-1510P

References · 6

• https://dlink-jp.com/product/dba-1510p#product_firmware · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6013 · Security Note
• https://bdu.fstec.ru/vul/2020-00046 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6013 · Vendor Advisory
• https://securitylab.ru/vulnerability/501590.php · Note
• http://jvn.jp/en/jp/JVN95875796/index.html · Note