An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.
References
Link | Resource |
---|---|
https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability3.md | Exploit Third Party Advisory |
https://github.com/kuc001/IoTFirmware/blob/master/Trendnet/Trendnet-TEW-632.pdf | Third Party Advisory |
Configurations
History
No history.
Information
Published : 2020-03-07 01:15
Updated : 2024-02-28 17:28
NVD link : CVE-2020-10213
Mitre link : CVE-2020-10213
CVE.ORG link : CVE-2020-10213
JSON object : View
Products Affected
dlink
- dir-825_firmware
- dir-825
trendnet
- tew-632brp_firmware
- tew-632brp
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')