D-Link DIR-846 100A35 SetWizardConfig.php SetWizardConfig Shell Metacharacter os command injection

Summaryinfo

A vulnerability categorized as critical has been discovered in D-Link DIR-846 100A35. This vulnerability affects the function SetWizardConfig of the file /squashfs-root/www/HNAP1/control/SetWizardConfig.php. Executing a manipulation as part of Shell Metacharacter can lead to os command injection. This vulnerability is registered as CVE-2019-17510. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability has been found in D-Link DIR-846 100A35 (Router Operating System) and classified as very critical. This vulnerability affects the function SetWizardConfig of the file /squashfs-root/www/HNAP1/control/SetWizardConfig.php. The manipulation as part of a Shell Metacharacter leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php.

The weakness was published 10/11/2019. This vulnerability was named CVE-2019-17510 since 10/11/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 01/08/2024). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

By approaching the search of inurl:squashfs-root/www/HNAP1/control/SetWizardConfig.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-143409. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-846

Version

• 100A35

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion