CVE-2018-10823

HIGH EXPLOITED IN THE WILD NUCLEI

Dlink Dwr-116 Firmware < 1.06 - OS Command Injection

Title source: rule

Description

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.

Exploits (1)

exploitdb WORKING POC
by Blazej Adamczyk · webappshardware
https://www.exploit-db.com/exploits/45676

Nuclei Templates (1)

D-Link Routers - Remote Command Injection
HIGHby wisnupramoedya

References (2)

Scores

CVSS v3 8.8
EPSS 0.9396
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2021-01-14
InTheWild.io 2018-10-19
CWE
CWE-78
Status published
Products (4)
dlink/dwr-111_firmware < 1.01
dlink/dwr-116_firmware < 1.06
dlink/dwr-512_firmware < 2.02
dlink/dwr-912_firmware < 2.02
Published Oct 17, 2018
Tracked Since Feb 18, 2026