Sign-up

ID

VAR-201307-0556


TITLE

Multiple Command Injection Vulnerabilities in Multiple D-Link Product UPnP SOAP Interfaces

Trust: 0.6

sources: CNVD: CNVD-2013-09199

DESCRIPTION

DIR-300, DIR-600, DIR-645, DIR-845 and DIR-865 The UPnP SOAP interface does not properly filter XML parameters, allowing remote attackers to exploit and exploit arbitrary commands, including: NewInternalClient, NewInternalClient, NewInternalPort. D-Link DIR-300, DIR-600, DIR-645, DIR-845, and DIR-865 are all wireless router products from Taiwan D-Link Corporation. Multiple command injection vulnerabilities exist in multiple D-Link products. An attacker could use these vulnerabilities to execute arbitrary commands in the context of an affected device. The following devices have vulnerabilities: DIR-300 rev B firmware 2.14b01, DIR-600 firmware 2.16b01, DIR-645 firmware 1.04b01, DIR-845 firmware 1.01b02, DIR- The 865 runs firmware version 1.05b03

Trust: 1.35

sources: CNVD: CNVD-2013-09199 // CNNVD: CNNVD-201307-279 // BID: 61005

IOT TAXONOMY

category:['IoT', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2013-09199

AFFECTED PRODUCTS

vendor:d linkmodel:dir-865l 1.05b03scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-845 1.01b02scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-645 1.04b01scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-600 2.16b01scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-300 rev b 2.14b01scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2013-09199

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2013-09199
value: HIGH

Trust: 0.6

CNVD: CNVD-2013-09199
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2013-09199

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201307-279

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-201307-279

PATCH

title:Patches for multiple command injection vulnerabilities in multiple D-Link products UPnP SOAP interfacesurl:https://www.cnvd.org.cn/patchinfo/show/35024

Trust: 0.6

sources: CNVD: CNVD-2013-09199

EXTERNAL IDS

db:BIDid:61005

Trust: 1.5

db:EXPLOIT-DBid:26664

Trust: 0.6

db:CNVDid:CNVD-2013-09199

Trust: 0.6

db:CNNVDid:CNNVD-201307-279

Trust: 0.6

sources: CNVD: CNVD-2013-09199 // BID: 61005 // CNNVD: CNNVD-201307-279

REFERENCES

url:http://www.exploit-db.com/exploits/26664/

Trust: 0.6

url:http://www.securityfocus.com/bid/61005

Trust: 0.6

url:http://www.dlink.com/

Trust: 0.3

sources: CNVD: CNVD-2013-09199 // BID: 61005 // CNNVD: CNNVD-201307-279

CREDITS

m-1-k-3

Trust: 0.9

sources: BID: 61005 // CNNVD: CNNVD-201307-279

SOURCES

db:CNVDid:CNVD-2013-09199
db:BIDid:61005
db:CNNVDid:CNNVD-201307-279

LAST UPDATE DATE

2022-05-17T01:55:57.136000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2013-09199date:2013-07-10T00:00:00
db:BIDid:61005date:2014-07-14T12:08:00
db:CNNVDid:CNNVD-201307-279date:2013-07-17T00:00:00

SOURCES RELEASE DATE

db:CNVDid:CNVD-2013-09199date:2013-07-10T00:00:00
db:BIDid:61005date:2013-07-07T00:00:00
db:CNNVDid:CNNVD-201307-279date:2013-07-17T00:00:00