| शीर्षक | D-Link DIR-852 1.00CN B09 Command Injection |
|---|
| विवरण | A command injection vulnerability exists in the D-Link DIR-852 router, firmware version 1.00CNB09. The vulnerability stems from improper input sanitization within the hedwig.cgi script when processing device settings, such as the NTP server configuration.
An authenticated attacker can submit a specially crafted payload containing malicious commands in the NTP server field via the web management interface (e.g., the tools_time.php page). Because the backend validation script only checks if the input is empty and fails to filter special characters, this malicious input is saved to the device's configuration. The backend service later retrieves this value and directly concatenates it into a system command for time synchronization, leading to arbitrary command execution with root privileges on the device. |
|---|
| स्रोत | ⚠️ https://github.com/i-Corner/cve/issues/31 |
|---|
| उपयोगकर्ता | iC0rner (UID 82839) |
|---|
| सबमिशन | 09/09/2025 08:44 AM (1 वर्ष पहले) |
|---|
| संयम | 17/09/2025 02:10 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 324658 [D-Link DIR-852 1.00CN B09 Web Management Interface hedwig.cgi अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|