CVE-2018-20114

CRITICAL

Dlink Dir-818lw Firmware - OS Command Injection

Title source: rule
STIX 2.1

Description

On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an "&&" substring in the service parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-6530.

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0673
EPSS Percentile 91.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
dlink/dir-818lw_firmware 2.05.b03
dlink/dir-860l_firmware 2.03.b03
Published Jan 02, 2019
Tracked Since Feb 18, 2026