PT-2019-8636 · D Link · D-Link Dcs-1130+1

Mandar Satam · Published 2019-07-02 · Updated 2021-04-23 · CVE-2017-8413

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 (affected versions not specified) D-Link DCS-1130 (affected versions not specified)

Description An issue was discovered in D-Link devices, where a custom daemon runs on UDP port 5978, handling a custom D-Link UDP-based protocol. This protocol allows D-Link mobile and desktop applications to discover devices on the local network. The daemon processes received UDP packets, and if a packet is received with a specific type, the string passed in the C parameter is base64 decoded and executed by passing into a System API. This allows a third-party application on the device to execute commands without authentication by sending a single UDP packet with custom base64 encoding.

Recommendations For D-Link DCS-1100, restrict access to the custom daemon on UDP port 5978 to minimize the risk of exploitation. For D-Link DCS-1130, consider disabling the dldps2121 daemon until a patch is available. Avoid using the C parameter in the custom protocol to prevent command execution. As a temporary workaround, consider blocking UDP packets sent to port 5978 from untrusted sources.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-8413

Affected Products

D-Link Dcs-1100

D-Link Dcs-1130

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-8413 · Security Note
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf · Note
• http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html · Note
• https://t.me/cibsecurity/5310 · Telegram Post
• https://seclists.org/bugtraq/2019/Jun/8 · Note