An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.
References
| Link | Resource |
|---|---|
| http://sploit.tech/2018/10/12/D-Link.html | Exploit Third Party Advisory |
| https://seclists.org/fulldisclosure/2018/Oct/36 | Exploit Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
History
26 Apr 2023, 19:27
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:d-link:dwr-111:-:*:*:*:*:*:*:* cpe:2.3:o:d-link:dwr-116_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:d-link:dwr-912:-:*:*:*:*:*:*:* cpe:2.3:h:d-link:dwr-512:-:*:*:*:*:*:*:* cpe:2.3:h:d-link:dwr-116:-:*:*:*:*:*:*:* cpe:2.3:o:d-link:dwr-512_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:d-link:dwr-111_firmware:*:*:*:*:*:*:*:* |
cpe:2.3:o:dlink:dwr-111_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:dlink:dwr-512_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:d-link:dwr-921:-:*:*:*:*:*:*:* cpe:2.3:h:dlink:dwr-512:-:*:*:*:*:*:*:* cpe:2.3:h:dlink:dwr-116:-:*:*:*:*:*:*:* cpe:2.3:h:dlink:dwr-111:-:*:*:*:*:*:*:* cpe:2.3:o:dlink:dwr-116_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:dlink:dwr-912_firmware:*:*:*:*:*:*:*:* |
Information
Published : 2018-10-17 14:29
Updated : 2024-02-04 20:03
NVD link : CVE-2018-10823
Mitre link : CVE-2018-10823
CVE.ORG link : CVE-2018-10823
JSON object : View
Products Affected
dlink
- dwr-111
- dwr-512
- dwr-116
- dwr-116_firmware
- dwr-512_firmware
- dwr-912_firmware
- dwr-921
- dwr-111_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')