PT-2019-4635 · D Link · D-Link Dcs-960L

Published 2019-12-23 · Updated 2021-10-29 · CVE-2019-17146

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-960L version 1.07.102

Description The issue is related to a buffer overflow in the memory of the HNAP service of D-Link DCS series Wi-Fi cameras, allowing a remote attacker to execute arbitrary code on the target device by sending a specially crafted SOAP request. The flaw exists within the HNAP service, which listens on TCP port 80 by default, and is caused by the process not properly validating the length of user-supplied data prior to copying it to a stack-based buffer. This can be exploited without authentication.

Recommendations For D-Link DCS-960L version 1.07.102, consider disabling the HNAP service as a temporary workaround until a patch is available. Restrict access to TCP port 80 to minimize the risk of exploitation. Avoid using the SOAPAction request header in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Stack Overflow

RCE

Weakness Enumeration

CWE-306

CWE-121

CWE-20

Related Identifiers

BDU:2020-00796

CVE-2019-17146

ZDI-19-1031

Affected Products

D-Link Dcs-960L

References · 6

• https://zerodayinitiative.com/advisories/ZDI-19-1031 · Security Note
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10142 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00796 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-17146 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17146 · Vendor Advisory
• https://securitylab.ru/vulnerability/503675.php · Note