RCE in D-Link Dir-868l Firmware
CVE-2018-19988
In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. It needs to bypass the wget command option with a single quote. A vulnerable /HNAP1/SetClientInfoDemo XML message could have single quotes and backquotes in the AudioMute or AudioEnable element, such as the '`telnetd`' string.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.074 (93.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- D-link Dir-868l_firmware — versions 2.05b02
- Dlink Dir-868l
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-19988?
- CVE-2018-19988 is a critical-severity vulnerability in D-Link Dir-868l Firmware, classified under OS Command Injection. CVSS score: 9.8/10. Published 2019-05-13.
- How severe is CVE-2018-19988?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2018-19988 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.