CVE-2013-7471
CRITICAL EXPLOITEDD-Link DIR-* - Command Injection
Title source: llmDescription
An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotehardware
https://www.exploit-db.com/exploits/27044
Scores
CVSS v3
9.8
EPSS
0.2041
EPSS Percentile
95.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Intel
VulnCheck KEV
2019-06-13
Classification
CWE
CWE-77
Status
published
Affected Products (5)
dlink/dir-300_firmware
dlink/dir-600_firmware
< 2.17b01
dlink/dir-645_firmware
< 1.04b11
dlink/dir-845_firmware
< 1.02b03
dlink/dir-865_firmware
Timeline
Published
Jun 11, 2019
Tracked Since
Feb 18, 2026