PT-2019-6343 · D Link · Dir-868L

Pr0V3Rbs · Published 2019-01-07 · Updated 2023-04-26 · CVE-2018-19988

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-868L Rev.B version 2.05B02

Description The issue arises from the lack of proper sanitization of special elements in the AudioMute and AudioEnable parameters within the /HNAP1/SetClientInfoDemo message. This allows for command injection when the SetClientInfoDemo.php script saves these parameters to the ShellPath script file without proper regex checking. An attacker can exploit this by crafting an XML message with single quotes and backquotes in the AudioMute or AudioEnable elements, such as the 'telnetd' string, to bypass the wget command option. This could enable a remote attacker to execute arbitrary commands.

Recommendations For D-Link DIR-868L Rev.B version 2.05B02, as a temporary workaround, consider disabling the SetClientInfoDemo.php script until a patch is available. Restrict access to the /HNAP1/SetClientInfoDemo API endpoint to minimize the risk of exploitation. Avoid using the AudioMute and AudioEnable parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-02681

CVE-2018-19988

Affected Products

Dir-868L

References · 6

• 🔥 https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990 · Exploit
• 🔥 https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-1998620-2019990 · Exploit
• https://bdu.fstec.ru/vul/2023-02681 · Security Note
• https://safe-surf.ru/upload/VULN.20190520.3.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-19988 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19988 · Vendor Advisory