A vulnerability, which was classified as problematic, has been found in D-Link DIR-645 1.03B08 (Router Operating System). This issue affects the function getfile. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality.

The weakness was published 12/19/2013 as SAP10008 as confirmed advisory (Website). The advisory is shared at securityadvisories.dlink.com. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1006 for this issue.

After immediately, there has been an exploit disclosed. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k.

Upgrading to version 1.04B11 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

dlink.com is providing further details. Similar entries are available at 11581, 11582, 11583 and 11584.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-645

Version

• 1.03B08

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion