CVE-2018-10823

HIGHNuclei

D-Link dwr-116_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-10823 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 14, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

dwr-116_firmware

Browse D-Link / dwr-116_firmware
VulnCheckVersion data not supplied

Proofs of concept

1

Catalogued exploits

ExploitDBD-Link Routers - Command InjectionExploitDB exploitby Blazej AdamczykNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHD-Link Routers - Remote Command InjectionCVSS 8.8

D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data theft, and complete compromise of the affected router.

Remediation

Apply the latest firmware update provided by D-Link to mitigate this vulnerability.

WeaknessesCWE-78
Authorswisnupramoedya
Template tagscvecve2018rceiotdlinkrouteredbseclistsvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:o:dlink:dwr-116_firmware:*:*:*:*:*:*:*:*
https://www.exploit-db.com/exploits/45676 https://nvd.nist.gov/vuln/detail/CVE-2018-10823 https://seclists.org/fulldisclosure/2018/Oct/36 http://sploit.tech/2018/10/12/D-Link.html https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3