CVE-2018-19988

In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. It needs to bypass the wget command option with a single quote. A vulnerable /HNAP1/SetClientInfoDemo XML message could have single quotes and backquotes in the AudioMute or AudioEnable element, such as the '`telnetd`' string.
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:d-link:dir-868l_firmware:2.05b02:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*

History

26 Apr 2023, 18:55

Type Values Removed Values Added
CPE cpe:2.3:h:d-link:dir-868l:-:*:*:*:*:*:*:* cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*

Information

Published : 2019-05-13 14:29

Updated : 2024-02-04 20:20


NVD link : CVE-2018-19988

Mitre link : CVE-2018-19988

CVE.ORG link : CVE-2018-19988


JSON object : View

Products Affected

dlink

  • dir-868l

d-link

  • dir-868l_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')