PT-2019-6336 · D Link · D-Link Dir-822

Pr0V3Rbs · Published 2019-01-07 · Updated 2023-04-26 · CVE-2018-19990

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-822 B1 version 202KRb06

Description The issue is related to insufficient checking of arguments passed to a command when handling the WPSPIN parameter in the SetWiFiVerifyAlpha.php script. This could allow a remote attacker to impact the integrity, availability, and confidentiality of protected information. The vulnerability is exploited through the /HNAP1/SetWiFiVerifyAlpha message, where the WPSPIN parameter can contain shell metacharacters, such as the telnetd string. In the affected devices, the WPSPIN parameter is saved in internal configuration memory without regex checking and is later used with the wpatalk command, also without any regex checking.

Recommendations For D-Link DIR-822 B1 version 202KRb06, as a temporary workaround, consider disabling the do wps function in the wps.php source code until a patch is available. Restrict access to the /HNAP1/SetWiFiVerifyAlpha API endpoint to minimize the risk of exploitation. Avoid using the WPSPIN parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-02618

CVE-2018-19990

Affected Products

D-Link Dir-822

References · 5

• 🔥 https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990 · Exploit
• https://osv.dev/vulnerability/CVE-2018-19990 · Vendor Advisory
• https://safe-surf.ru/upload/VULN.20190520.3.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-19990 · Security Note
• https://bdu.fstec.ru/vul/2023-02618 · Security Note