D-Link Central WiFi Manager prior 1.03r0100-Beta1 FTP Server username/password unrestricted upload

Summaryinfo

A vulnerability was found in D-Link Central WiFi Manager. It has been rated as critical. The impacted element is an unknown function of the component FTP Server. Performing a manipulation of the argument username/password with the input admin:admin results in unrestricted upload. This vulnerability is known as CVE-2018-17440. Remote exploitation of the attack is possible. Furthermore, an exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in D-Link Central WiFi Manager (Wireless LAN Software). This affects an unknown function of the component FTP Server. The manipulation of the argument username/password with the input value admin:admin leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking advantage of this, a remote unauthenticated attacker could execute arbitrary PHP code by uploading any file in the web root directory and then accessing it via a request.

The bug was discovered 06/04/2018. The weakness was published 10/08/2018 as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. This vulnerability is uniquely identified as CVE-2018-17440 since 09/24/2018. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 126 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 1.03r0100-Beta1 eliminates this vulnerability.It is possible to mitigate the weakness by firewalling tcp/9000. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Exploit-DB (45533). Similar entries are available at VDB-125057, VDB-125056 and VDB-125058. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• D-Link

Name

• Central WiFi Manager

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion