Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-19987

D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code, the IsAccessPoint parameter is saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. A vulnerable /HNAP1/SetAccessPointMode XML message could have shell metacharacters in the IsAccessPoint element such as the `telnetd` string.

Published

2019-05-13T14:29:01.207

Last Modified

2024-11-21T03:58:56.823

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-78
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System d-link dir-818lw_firmware 2.05.b03 Yes
Hardware dlink dir-818lw - No
Operating System d-link dir-822_firmware 202krb06 Yes
Operating System dlink dir-822_firmware 3.10b06 Yes
Hardware dlink dir-822 - No
Operating System d-link dir-860l_firmware 2.03.b03 Yes
Hardware dlink dir-860l - No
Operating System d-link dir-868l_firmware 2.05b02 Yes
Hardware dlink dir-868l - No
Operating System d-link dir-880l_firmware 1.20b01_01_i3se Yes
Hardware dlink dir-880l - No
Operating System d-link dir-890l\/r_firmware 1.21b02 Yes
Hardware dlink dir-890l\/r - No
References