SB2018101711 - Multiple vulnerabilities in D-Link routers

Description

This security bulletin contains information about 3 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2018-10822)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to path traversal in the web interface on D-Link routers. A remote attacker can send a /.. or // after “GET /uir” in an HTTP request, conduct directory traversal and gain access to important data.

NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.

2) OS command injection (CVE-ID: CVE-2018-10823)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber

The vulnerability allows a remote authenticated attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to insufficient sanitization of user-supplied data within the chkisg.htm page Sip parameter. A remote authenticated attacker can inject and execute arbitrary code with elevated privileges.

3) Path traversal (CVE-ID: CVE-2018-10824)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a remote attacker to conduct directory traversal.

The weakness exists due to the administrative password is stored in plaintext in the /tmp/XXX/0 file. A remote attacker can send a /.. or // after “GET /uir” in an HTTP request, conduct directory traversal and get full router access.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://sploit.tech/2018/10/12/D-Link.html