D-Link DIR-818LW/DIR-822 B1 SetRouterSettings.php IPTWAN_build_command RemotePort command injection

Summaryinfo

A vulnerability classified as critical was found in D-Link DIR-818LW and DIR-822 B1. The affected element is the function IPTWAN_build_command of the file SetRouterSettings.php. Such manipulation of the argument RemotePort as part of Shell Metacharacter leads to command injection. This vulnerability is traded as CVE-2018-19986. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in D-Link DIR-818LW and DIR-822 B1 (Router Operating System) (version unknown). Affected by this issue is the function IPTWAN_build_command of the file SetRouterSettings.php. The manipulation of the argument RemotePort as part of a Shell Metacharacter leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices. In the SetRouterSettings.php source code, the RemotePort parameter is saved in the $path_inf_wan1."/web" internal configuration memory without any regex checking. And in the IPTWAN_build_command function of the iptwan.php source code, the data in $path_inf_wan1."/web" is used with the iptables command without any regex checking. A vulnerable /HNAP1/SetRouterSettings XML message could have shell metacharacters in the RemotePort element such as the `telnetd` string.

The weakness was shared 05/13/2019. This vulnerability is handled as CVE-2018-19986 since 12/09/2018. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/15/2023). The MITRE ATT&CK project declares the attack technique as T1202.

By approaching the search of inurl:SetRouterSettings.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-818LW
• DIR-822 B1

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion