| 标题 | D-Link DIR-882 DIR882A1_FW130B06 Command Injection |
|---|
| 描述 | A critical command injection vulnerability exists in the HNAP interface of multiple D-Link DIR-882 firmware versions(DIR882A1_FW130B06,DIR882A1_FW130B06_Hotfix_02 Beta,DIR882A1_FW130B06_Hotfix_03 Beta). By sending a specifically crafted `SetWanSettings` SOAP request, an authenticated attacker can inject arbitrary shell commands that are executed with **root privileges**. This occurs due to insufficient sanitization of the `Username` and `Password` fields before they are passed to a system shell command in the `rc`service. |
|---|
| 来源 | ⚠️ https://m0dzer0.github.io/notes/docs/Dlink_DIR-882_POC |
|---|
| 用户 | zeroking (UID 70396) |
|---|
| 提交 | 2026-05-15 08時57分 (5 月前) |
|---|
| 管理 | 2026-06-02 17時33分 (18 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 216714 [D-Link DIR-882 130B06 SetWanSettings Password 内存损坏] |
|---|
| 积分 | 0 |
|---|