SB2018101711 - Multiple vulnerabilities in D-Link routers

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2018-10822)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to path traversal in the web interface on D-Link routers. A remote attacker can send a /.. or // after “GET /uir” in an HTTP request, conduct directory traversal and gain access to important data.

NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.

2) OS command injection (CVE-ID: CVE-2018-10823)

The vulnerability allows a remote authenticated attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to insufficient sanitization of user-supplied data within the chkisg.htm page Sip parameter. A remote authenticated attacker can inject and execute arbitrary code with elevated privileges.

3) Path traversal (CVE-ID: CVE-2018-10824)

The vulnerability allows a remote attacker to conduct directory traversal.

The weakness exists due to the administrative password is stored in plaintext in the /tmp/XXX/0 file. A remote attacker can send a /.. or // after “GET /uir” in an HTTP request, conduct directory traversal and get full router access.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://sploit.tech/2018/10/12/D-Link.html