An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.
References
Link | Resource |
---|---|
https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability2.md | Exploit Third Party Advisory |
https://github.com/kuc001/IoTFirmware/blob/master/Trendnet/Trendnet-TEW-632.pdf | Third Party Advisory |
Configurations
History
No history.
Information
Published : 2020-03-07 01:15
Updated : 2024-02-28 17:28
NVD link : CVE-2020-10215
Mitre link : CVE-2020-10215
CVE.ORG link : CVE-2020-10215
JSON object : View
Products Affected
dlink
- dir-825
- dir-825_firmware
trendnet
- tew-632brp
- tew-632brp_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')