A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (within range of the repeater) to run shell commands as root during the setup process of the repeater, via a crafted SSID. Also, network names containing single quotes (in the range of the repeater) can result in a denial of service.
References
| Link | Resource |
|---|---|
| https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection | Exploit Product Third Party Advisory |
| https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection | Exploit Product Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 08:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection - Exploit, Product, Third Party Advisory |
16 Oct 2023, 18:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection - Exploit, Product, Third Party Advisory | |
| First Time |
Dlink
Dlink dap-1860 Dlink dap-1860 Firmware |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-77 | |
| CPE | cpe:2.3:o:dlink:dap-1860_firmware:1.00:*:*:*:*:*:*:* cpe:2.3:o:dlink:dap-1860_firmware:1.01b05-01:*:*:*:*:*:*:* cpe:2.3:o:dlink:dap-1860_firmware:1.01b94:*:*:*:*:*:*:* cpe:2.3:h:dlink:dap-1860:-:*:*:*:*:*:*:* |
10 Oct 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-10 05:15
Updated : 2024-11-21 08:26
NVD link : CVE-2023-45208
Mitre link : CVE-2023-45208
CVE.ORG link : CVE-2023-45208
JSON object : View
Products Affected
dlink
- dap-1860_firmware
- dap-1860
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')