Sign-up

ID

VAR-201810-0936


CVE

CVE-2018-10823


TITLE

plural D-Link Command injection vulnerability in the product

Trust: 0.8

sources: JVNDB: JVNDB-2018-013710

DESCRIPTION

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals. plural D-Link The product contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. DWR-116, DIR-140, DIR-640, etc. are all D-Link router products. There are shell command injection vulnerabilities in multiple series of http-servers of D-Link routers. D-Link DWR-116, etc. The following products and versions are affected: D-Link DWR-116 1.06 and earlier; DWR-512 2.02 and earlier; DWR-712 2.02 and earlier; DWR-912 2.02 and earlier; DWR-921 2.02 and earlier; DWR-111 1.01 and earlier versions. An issue exists on D-Link DWR-116 up to and including 1.06, DWR-512 up to and including 2.02, DWR-712 up to and including 2.02, DWR-912 up to and including 2.02, DWR-921 up to and including 2.02, and DWR-111 up to and including 1.01 devices. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa MULTIPLE VULNERABILITIES IN D-LINK ROUTERS Blazej Adamczyk (br0x) blazej.adamczyk@gmail.com http://sploit.tech/ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 12.10.2018 1 Directory Traversal in httpd server in several series of D-Link routers aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aa CVE: CVE-2018-10822 CVSS v3: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Directory traversal vulnerability in the web interface on D-Link routers: aC/ DWR-116 through 1.06, aC/ DIR-140L through 1.02, aC/ DIR-640L through 1.02, aC/ DWR-512 through 2.02, aC/ DWR-712 through 2.02, aC/ DWR-912 through 2.02, aC/ DWR-921 through 2.02, aC/ DWR-111 through 1.01, aC/ and probably others with the same type of firmware allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190. PoC: aaaaa a $ curl http://routerip/uir//etc/passwd aaaaa The vulnerability can be used retrieve administrative password using the other disclosed vulnerability - CVE-2018-10824 This vulnerability was reported previously by Patryk Bogdan in CVE-2017-6190 but he reported it is fixed in certain release but unfortunately it is still present in even newer releases. The vulnerability is also present in other D-Link routers and can be exploited not only (as the original author stated) by double dot but also absolutely using double slash. 2 Password stored in plaintext in several series of D-Link routers aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa CVE: CVE-2018-10824 An issue was discovered on D-Link routers: aC/ DWR-116 through 1.06, aC/ DIR-140L through 1.02, aC/ DIR-640L through 1.02, aC/ DWR-512 through 2.02, aC/ DWR-712 through 2.02, aC/ DWR-912 through 2.02, aC/ DWR-921 through 2.02, aC/ DWR-111 through 1.01, aC/ and probably others with the same type of firmware. NOTE: I have changed the filename in description to XXX because the vendor leaves some EOL routers unpatched and the attack is too simple. The administrative password is stored in plaintext in the /tmp/XXX/0 file. An attacker having a directory traversal (or LFI) can easily get full router access. PoC using the directory traversal vulnerability disclosed at the same time - CVE-2018-10822 aaaaa a $ curl http://routerip/uir//tmp/XXX/0 aaaaa This command returns a binary config file which contains admin username and password as well as many other router configuration settings. By using the directory traversal vulnerability it is possible to read the file without authentication. 3 Shell command injection in httpd server of a several series of D-Link routers aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaa CVE: CVE-2018-10823 CVSS v3: 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) An issue was discovered on D-Link routers: aC/ DWR-116 through 1.06, aC/ DWR-512 through 2.02, aC/ DWR-712 through 2.02, aC/ DWR-912 through 2.02, aC/ DWR-921 through 2.02, aC/ DWR-111 through 1.01, aC/ and probably others with the same type of firmware. PoC: 1. 2. Request the following URL after login: aaaaa a $ curl http://routerip/chkisg.htm%3FSip%3D1.1.1.1%20%7C%20cat%20 %2Fetc%2Fpasswd aaaaa 3. See the passwd file contents in the response. 4 Exploiting all together aaaaaaaaaaaaaaaaaaaaaaaaa CVSS v3: 10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Taking all the three together it is easy to gain full router control including arbitrary code execution. Description with video: [http://sploit.tech/2018/10/12/D-Link.html] 5 Timeline aaaaaaaaaa aC/ 09.05.2018 - vendor notified aC/ 06.06.2018 - asked vendor about the status because of long vendor response aC/ 22.06.2018 - received a reply that a patch will be released for DWR-116 and DWR-111, for the other devices which are EOL an announcement will be released aC/ 09.09.2018 - still no reply from vendor about the patches or announcement, I have warned the vendor that if I will not get a reply in a month I will publish the disclosure aC/ 12.10.2018 - disclosing the vulnerabilities

Trust: 2.43

sources: NVD: CVE-2018-10823 // JVNDB: JVNDB-2018-013710 // CNVD: CNVD-2018-21067 // VULHUB: VHN-120621 // VULMON: CVE-2018-10823 // PACKETSTORM: 149844

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-21067

AFFECTED PRODUCTS

vendor:dlinkmodel:dwr-512scope:lteversion:2.02

Trust: 1.0

vendor:dlinkmodel:dwr-116scope:lteversion:1.06

Trust: 1.0

vendor:dlinkmodel:dwr-912scope:lteversion:2.02

Trust: 1.0

vendor:dlinkmodel:dwr-111scope:lteversion:1.01

Trust: 1.0

vendor:d linkmodel:dwr-111scope:lteversion:1.01

Trust: 0.8

vendor:d linkmodel:dwr-116scope:lteversion:1.06

Trust: 0.8

vendor:d linkmodel:dwr-512scope:lteversion:2.02

Trust: 0.8

vendor:d linkmodel:dwr-912scope:lteversion:2.02

Trust: 0.8

vendor:d linkmodel:dwr-116scope:ltversion:1.06

Trust: 0.6

vendor:d linkmodel:dir-140lscope:ltversion:1.02

Trust: 0.6

vendor:d linkmodel:dir-640lscope:ltversion:1.02

Trust: 0.6

vendor:d linkmodel:dwr-512scope:ltversion:2.02

Trust: 0.6

vendor:d linkmodel:dwr-712scope:ltversion:2.02

Trust: 0.6

vendor:d linkmodel:dwr-912scope:ltversion:2.02

Trust: 0.6

vendor:d linkmodel:dwr-921scope:ltversion:2.02

Trust: 0.6

vendor:d linkmodel:dwr-111scope:ltversion:1.01

Trust: 0.6

sources: CNVD: CNVD-2018-21067 // JVNDB: JVNDB-2018-013710 // NVD: CVE-2018-10823

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-10823
value: HIGH

Trust: 1.0

NVD: CVE-2018-10823
value: HIGH

Trust: 0.8

CNVD: CNVD-2018-21067
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201810-1015
value: HIGH

Trust: 0.6

VULHUB: VHN-120621
value: HIGH

Trust: 0.1

VULMON: CVE-2018-10823
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-10823
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2018-21067
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-120621
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-10823
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2018-10823
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2018-21067 // VULHUB: VHN-120621 // VULMON: CVE-2018-10823 // JVNDB: JVNDB-2018-013710 // CNNVD: CNNVD-201810-1015 // NVD: CVE-2018-10823

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:CWE-77

Trust: 0.9

sources: VULHUB: VHN-120621 // JVNDB: JVNDB-2018-013710 // NVD: CVE-2018-10823

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-1015

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201810-1015

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-013710

PATCH
title:Top Pageurl:http://www.dlink.lt/en/
Trust: 0.8
title:D-Link router httpdservershell command to inject vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/142553
Trust: 0.6
title:Kenzer Templates [5170] [DEPRECATED]url:https://github.com/ARPSyndicate/kenzer-templates 
Trust: 0.1
title:The Registerurl:https://www.theregister.co.uk/2018/10/17/dlink_security_flaws/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-21067 // 
            
            
            
            VULMON: CVE-2018-10823 // 
            
            
            
            JVNDB: JVNDB-2018-013710

EXTERNAL IDS
db:NVDid:CVE-2018-10823
Trust: 3.3
db:JVNDBid:JVNDB-2018-013710
Trust: 0.8
db:CNNVDid:CNNVD-201810-1015
Trust: 0.7
db:CNVDid:CNVD-2018-21067
Trust: 0.6
db:VULHUBid:VHN-120621
Trust: 0.1
db:VULMONid:CVE-2018-10823
Trust: 0.1
db:PACKETSTORMid:149844
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-21067 // 
            
            
            
            VULHUB: VHN-120621 // 
            
            
            
            VULMON: CVE-2018-10823 // 
            
            
            
            JVNDB: JVNDB-2018-013710 // 
            
            
            
            PACKETSTORM: 149844 // 
            
            
            
            CNNVD: CNNVD-201810-1015 // 
            
            
            
            NVD: CVE-2018-10823

REFERENCES
url:http://sploit.tech/2018/10/12/d-link.html
Trust: 2.6
url:https://seclists.org/fulldisclosure/2018/oct/36
Trust: 2.5
url:https://nvd.nist.gov/vuln/detail/cve-2018-10823
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10823
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/78.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/arpsyndicate/kenzer-templates
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-6190
Trust: 0.1
url:http://routerip/uir//tmp/xxx/0
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-10822
Trust: 0.1
url:http://sploit.tech/
Trust: 0.1
url:http://routerip/uir//etc/passwd
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-10824
Trust: 0.1
url:http://sploit.tech/2018/10/12/d-link.html]
Trust: 0.1
url:http://routerip/chkisg.htm%3fsip%3d1.1.1.1%20%7c%20cat%20
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-21067 // 
            
            
            
            VULHUB: VHN-120621 // 
            
            
            
            VULMON: CVE-2018-10823 // 
            
            
            
            JVNDB: JVNDB-2018-013710 // 
            
            
            
            PACKETSTORM: 149844 // 
            
            
            
            CNNVD: CNNVD-201810-1015 // 
            
            
            
            NVD: CVE-2018-10823

CREDITS
Blazej Adamczyk
Trust: 0.1
sources:
            
            
            PACKETSTORM: 149844

SOURCES
db:CNVDid:CNVD-2018-21067
db:VULHUBid:VHN-120621
db:VULMONid:CVE-2018-10823
db:JVNDBid:JVNDB-2018-013710
db:PACKETSTORMid:149844
db:CNNVDid:CNNVD-201810-1015
db:NVDid:CVE-2018-10823

LAST UPDATE DATE
2024-08-14T14:39:12.422000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-21067date:2018-10-17T00:00:00
db:VULHUBid:VHN-120621date:2019-10-03T00:00:00
db:VULMONid:CVE-2018-10823date:2023-11-08T00:00:00
db:JVNDBid:JVNDB-2018-013710date:2019-02-28T00:00:00
db:CNNVDid:CNNVD-201810-1015date:2019-10-23T00:00:00
db:NVDid:CVE-2018-10823date:2023-11-08T22:46:49.570

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-21067date:2018-10-17T00:00:00
db:VULHUBid:VHN-120621date:2018-10-17T00:00:00
db:VULMONid:CVE-2018-10823date:2018-10-17T00:00:00
db:JVNDBid:JVNDB-2018-013710date:2019-02-28T00:00:00
db:PACKETSTORMid:149844date:2018-10-18T03:47:09
db:CNNVDid:CNNVD-201810-1015date:2018-10-18T00:00:00
db:NVDid:CVE-2018-10823date:2018-10-17T14:29:00.787