| 제목 | D-LINK DNS-340L, DNS-320L, DNS-327L, DNS-325 Version 1.11, Version 1.00.0409.2013, Version 1.09, Version 1.08, Version 1.03.0904.2013, Version 1.01 Command Injection, Backdoor Account |
|---|
| 설명 | The described vulnerability affects multiple D-Link NAS devices, including models DNS-340L, DNS-320L, DNS-327L, and DNS-325, among others. The vulnerability lies within the nas_sharing.cgi uri, which is vulnerable due to two main issues: a backdoor facilitated by hardcoded credentials, and a command injection vulnerability via the system parameter. This exploitation could lead to arbitrary command execution on the affected D-Link NAS devices, granting attackers potential access to sensitive information, system configuration alteration, or denial of service, by specifying a command, affecting over 92,000 devices on the Internet. |
|---|
| 원천 | ⚠️ https://github.com/netsecfish/dlink |
|---|
| 사용자 | netsecfish (UID 64568) |
|---|
| 제출 | 2024. 03. 26. PM 01:09 (2 연령 ago) |
|---|
| 모더레이션 | 2024. 04. 03. PM 08:23 (8 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 259284 [D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L 까지 20240403 HTTP GET Request /cgi-bin/nas_sharing.cgi system 권한 상승] |
|---|
| 포인트들 | 20 |
|---|