CVE-2020-18568

EUVD-2020-10492
The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause remote command execution.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
Affected Products (NVD)
VendorProductVersion
dlinkdsr-250_firmware
3.14
dlinkdsr-1000n_firmware
2.11b201:b201
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/WinMin/5b2bc43b517503472bb28a298981ed5a
https://www.dlink.com/en/security-bulletin/
https://gist.github.com/WinMin/5b2bc43b517503472bb28a298981ed5a
https://www.dlink.com/en/security-bulletin/