An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.
References
Link | Resource |
---|---|
http://sploit.tech/2018/10/12/D-Link.html | Exploit Third Party Advisory |
https://seclists.org/fulldisclosure/2018/Oct/36 | Exploit Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
AND |
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
History
08 Nov 2023, 22:46
Type | Values Removed | Values Added |
---|---|---|
First Time |
Dlink dwr-921
|
|
CPE | cpe:2.3:h:dlink:dwr-921:-:*:*:*:*:*:*:* |
Information
Published : 2018-10-17 14:29
Updated : 2024-02-28 16:48
NVD link : CVE-2018-10823
Mitre link : CVE-2018-10823
CVE.ORG link : CVE-2018-10823
JSON object : View
Products Affected
dlink
- dwr-921
- dwr-512_firmware
- dwr-111_firmware
- dwr-116_firmware
- dwr-116
- dwr-512
- dwr-912_firmware
- dwr-111
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')