CVE-2019-13128

EUVD-2019-4663
An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the IPAddress or Gateway field to SetStaticRouteSettings.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
dlinkdir-823g_firmware
1.02b03:b03
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/DIR-823G-v2.pdf
https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/DIR-823G-v2.pdf