PT-2022-1648 · D Link · D-Link Router Dir-846

Published 2022-02-17 · Updated 2022-02-25 · CVE-2021-46315

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link Router DIR-846 versions DIR846A1 FW100A43.bin through DIR846enFW100A53DLA-Retail.bin

Description A Remote Command Execution (RCE) issue exists due to insufficient argument validation in the SetWizardConfig.php script within the HNAP1/control directory. This allows malicious users to execute arbitrary commands by using shell metacharacters, such as backticks or line breaks, in the ssid0 or ssid1 parameters.

Recommendations For D-Link Router DIR-846 versions DIR846A1 FW100A43.bin through DIR846enFW100A53DLA-Retail.bin, consider disabling the SetWizardConfig.php script in the HNAP1/control directory until a patch is available to prevent exploitation. Restrict access to the ssid0 and ssid1 parameters in the affected API endpoint to minimize the risk of command execution. Avoid using the parameters ssid0 and ssid1 in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-00897

CVE-2021-46315

Affected Products

D-Link Router Dir-846

References · 7

• 🔥 https://github.com/doudoudedi/DIR-846_Command_Injection/blob/main/DIR-846_Command_Injection1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46315 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46315 · Vendor Advisory
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00897 · Security Note
• https://t.me/cvenotify/26954 · Telegram Post
• https://t.me/cibsecurity/37684 · Telegram Post