CVE-2018-19988

In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. It needs to bypass the wget command option with a single quote. A vulnerable /HNAP1/SetClientInfoDemo XML message could have single quotes and backquotes in the AudioMute or AudioEnable element, such as the '`telnetd`' string.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:d-link:dir-868l_firmware:2.05b02:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*

History

26 Apr 2023, 18:55

Type	Values Removed	Values Added
CPE	cpe:2.3:h:d-link:dir-868l:-:::::::*	cpe:2.3:h:dlink:dir-868l:-:::::::*

Information

Published : 2019-05-13 14:29

Updated : 2024-02-04 20:20

NVD link : CVE-2018-19988

Mitre link : CVE-2018-19988

CVE.ORG link : CVE-2018-19988

JSON object : View

Products Affected

dlink

dir-868l

d-link

dir-868l_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2018-19988", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-05-13T14:29:01.270", "references": [{"url": "https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. It needs to bypass the wget command option with a single quote. A vulnerable /HNAP1/SetClientInfoDemo XML message could have single quotes and backquotes in the AudioMute or AudioEnable element, such as the '`telnetd`' string."}, {"lang": "es", "value": "En el mensaje HNAP1/SetClientInfoDemo, los par\u00e1metros AudioMute y AudioEnable son vulnerables y las vulnerabilidades afectan a los dispositivos D-Link DIR-868L Rev.B 2.05B02. En el c\u00f3digo fuente del archivo SetClientInfoDemo.php, los par\u00e1metros AudioMute y AudioEnble se guardan en el archivo de script shellPath sin ninguna comprobaci\u00f3n regex. Despue\u00e9s que se ejecuta el archivo de script, se produce la inyecci\u00f3n de comandos. Debe omitir la opci\u00f3n del comando wget con una sola cita. Un mensaje XML vulnerable /HNAP1/SetClientInfoDemo podr\u00eda tener comillas simples e invertidas en el elemento AudioMute o AudioEnable, como la cadena '`telnetd`'."}], "lastModified": "2023-04-26T18:55:30.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:d-link:dir-868l_firmware:2.05b02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21680BA3-2C38-4E14-97F4-480F5B6EC3FB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "33B501D4-BDDD-485E-A5A3-8AA8D5E46061"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}