Input validation error in Central WiFiManager - CVE-2018-15515
Published: January 31, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU36179
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-15515
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: D-Link
Affected software:
Central WiFiManager
Central WiFiManager
Detailed vulnerability description
The vulnerability allows a local authenticated user to execute arbitrary code.
The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the CaptivelPortal.exe subdirectory under the D-Link directory, which allows unprivileged local users to gain SYSTEM privileges.
How to mitigate CVE-2018-15515
Install update from vendor's website.