D-Link DIR-822 B1 SetWiFiVerifyAlpha do_wps WPSPIN command injection

Summaryinfo

A vulnerability was found in D-Link DIR-822 B1 and classified as critical. Affected is the function do_wps of the file /HNAP1/SetWiFiVerifyAlpha. The manipulation of the argument WPSPIN as part of Shell Metacharacter results in command injection. This vulnerability was named CVE-2018-19990. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in D-Link DIR-822 B1 (Router Operating System) (the affected version is unknown). It has been classified as critical. Affected is the function do_wps of the file /HNAP1/SetWiFiVerifyAlpha. The manipulation of the argument WPSPIN as part of a Shell Metacharacter leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pin" and $rphyinf3."/media/wps/enrollee/pin" internal configuration memory without any regex checking. And in the do_wps function of the wps.php source code, the data in $rphyinf3."/media/wps/enrollee/pin" is used with the wpatalk command without any regex checking. A vulnerable /HNAP1/SetWiFiVerifyAlpha XML message could have shell metacharacters in the WPSPIN element such as the `telnetd` string.

The weakness was presented 05/13/2019. This vulnerability is traded as CVE-2018-19990 since 12/09/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/17/2023). The MITRE ATT&CK project declares the attack technique as T1202.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-822 B1

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion