D-Link DIR-816 A2 1.10 B05 /goform/Diagnosis handler sendNum command injection

Summaryinfo

A vulnerability has been found in D-Link DIR-816 A2 1.10 B05 and classified as critical. Impacted is the function handler of the file /goform/Diagnosis. The manipulation of the argument sendNum as part of Shell Metacharacter leads to command injection. This vulnerability is referenced as CVE-2018-17068. Remote exploitation of the attack is possible. No exploit is available. It is recommended to apply restrictive firewalling.

Detailsinfo

A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10 B05 (Router Operating System). This issue affects the function handler of the file /goform/Diagnosis. The manipulation of the argument sendNum as part of a Shell Metacharacter leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/Diagnosis route. This could lead to command injection via shell metacharacters in the sendNum parameter.

The bug was discovered 09/06/2018. The weakness was published 09/15/2018 (Website). The advisory is shared at github.com. The identification of this vulnerability is CVE-2018-17068 since 09/15/2018. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/24/2020). MITRE ATT&CK project uses the attack technique T1202 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $5k-$25k.

Addressing this vulnerability is possible by firewalling .

Similar entries are available at VDB-124084, VDB-124083, VDB-124082 and VDB-124081. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-816 A2

Version

• 1.10 B05

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion