D-Link DIR-860L/DIR-865L/DIR-868L soap.cgi service os command injection

Summaryinfo

A vulnerability was found in D-Link DIR-860L, DIR-865L and DIR-868L and classified as critical. The impacted element is an unknown function of the file soap.cgi. The manipulation of the argument service as part of Parameter results in os command injection. This vulnerability is reported as CVE-2018-6530. The attack can be launched remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as critical, was found in D-Link DIR-860L, DIR-865L and DIR-868L (Router Operating System) (the affected version is unknown). Affected is an unknown code of the file soap.cgi. The manipulation of the argument service as part of a Parameter leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

The bug was discovered 03/02/2018. The weakness was disclosed 03/06/2018 (Website). The advisory is shared for download at FTP2.DLINK.COM. This vulnerability is traded as CVE-2018-6530 since 02/02/2018. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a exploit are known. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/05/2025). The MITRE ATT&CK project declares the attack technique as T1202.

It is declared as attacked. The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $5k-$25k. This issue was added on 09/08/2022 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 09/29/2022:

The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it sh

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-114129, VDB-114130 and VDB-114131 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-860L
• DIR-865L
• DIR-868L

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion