Vulnerability CVE-2018-10823

Vulnerability CVE-2018-10823

Published: 2018-10-17

Description:

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.

See advisories in our WLB2 database:

	Topic	Author	Date
High	D-Link Plain-Text Password Storage / Code Execution / Directory Traversal	Blazej Adamczyk	19.10.2018

Type:

CWE-78

(Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') )

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
9/10	10/10	8/10

Exploit range	Attack complexity	Authentication
Remote	Low	Single time
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
D-link -> Dwr-111 firmware
D-link -> Dwr-116 firmware
D-link -> Dwr-512 firmware
D-link -> Dwr-912 firmware

References:

http://sploit.tech/2018/10/12/D-Link.html

https://seclists.org/fulldisclosure/2018/Oct/36

Copyright 2024, cxsecurity.com