CVEvulnerability

CVE-2018-19300

9.8 CRITICAL Published 2019-04-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-04-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20

Description

On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) before firmware version 2.04b01, DWR-921 (A1) before firmware version 1.02b01, and DWR-921 (B1) before firmware version 2.03b01, there exists an EXCU_SHELL file in the web directory. By sending a GET request with specially crafted headers to the /EXCU_SHELL URI, an attacker could execute arbitrary shell commands in the root context on the affected device. Other devices might be affected as well.

Affected configurations

• d-link dap-1530 firmware (<= 1.05) • d-link dap-1610 firmware (<= 1.05) • dlink dwr-111 firmware (<= 1.01) • d-link dwr-116 firmware 1.06 • dlink dwr-116 firmware (<= 1.05) • dlink dwr-512 firmware (<= 2.02) • d-link dwr-711 firmware (<= 1.11) • dlink dwr-712 firmware (<= 2.02) • dlink dwr-921 firmware (<= 1.02) • dlink dwr-921 firmware (<= 2.02)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References