A vulnerability, which was classified as critical, has been found in D-Link DCS-1100 and DCS-1130 (affected version unknown). Affected by this issue is the function sub_C210 of the file /var/www/video/mp4ts of the component Log File. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack.

The weakness was published 07/02/2019 as not defined mailinglist post (Bugtraq). The advisory is shared for download at seclists.org. This vulnerability is handled as CVE-2017-8412 since 05/02/2017. The attack can only be done within the local network. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/15/2023).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-136204, VDB-136205, VDB-136206 and VDB-136207. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• D-Link

Name

• DCS-1100
• DCS-1130

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion