CVE-2019-13481

EUVD-2019-4947
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to SetWanSettings.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
dlinkdir-818lw_firmware
2.06:betab01
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/109131
https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-3.pdf
http://www.securityfocus.com/bid/109131
https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-3.pdf