Details of VAR-201809-0516

ID

VAR-201809-0516

CVE

CVE-2018-16408

TITLE

D-Link DIR-846 Vulnerability related to access control in device firmware

Trust: 0.8

sources: JVNDB: JVNDB-2018-009640

DESCRIPTION

D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a SetNetworkTomographySettings request by leveraging admin access. D-Link DIR-846 There is an access control vulnerability in the device firmware.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDIR-846 is a wireless router product from D-Link

Trust: 2.25

sources: NVD: CVE-2018-16408 // JVNDB: JVNDB-2018-009640 // CNVD: CNVD-2019-02396 // VULHUB: VHN-126764

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-02396

AFFECTED PRODUCTS

vendor:

d link

model:

dir-846

scope:

version:

100.26

Trust: 3.0

sources: CNVD: CNVD-2019-02396 // JVNDB: JVNDB-2018-009640 // CNNVD: CNNVD-201809-095 // NVD: CVE-2018-16408

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-16408
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-16408
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2019-02396
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201809-095
value:	HIGH
Trust: 0.6
VULHUB:	VHN-126764
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-16408
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2019-02396
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-126764
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-16408
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2019-02396 // VULHUB: VHN-126764 // JVNDB: JVNDB-2018-009640 // CNNVD: CNNVD-201809-095 // NVD: CVE-2018-16408

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.1
problemtype:	CWE-284	Trust: 0.9
problemtype:	CWE-269	Trust: 0.1

sources: VULHUB: VHN-126764 // JVNDB: JVNDB-2018-009640 // NVD: CVE-2018-16408

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-095

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201809-095

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-009640

PATCH

title:

DIR-846

url:

http://www.dlink.com.cn/home/product?id=2995&hid=27

Trust: 0.8

sources: JVNDB: JVNDB-2018-009640

EXTERNAL IDS

db:	NVD	id:	CVE-2018-16408	Trust: 3.1
db:	JVNDB	id:	JVNDB-2018-009640	Trust: 0.8
db:	CNNVD	id:	CNNVD-201809-095	Trust: 0.7
db:	CNVD	id:	CNVD-2019-02396	Trust: 0.6
db:	VULHUB	id:	VHN-126764	Trust: 0.1

sources: CNVD: CNVD-2019-02396 // VULHUB: VHN-126764 // JVNDB: JVNDB-2018-009640 // CNNVD: CNNVD-201809-095 // NVD: CVE-2018-16408

REFERENCES

url:	https://www.us-cert.gov/ncas/bulletins/sb18-253	Trust: 2.4
url:	https://github.com/pagalaxylab/vulinfo/blob/master/d-link/dir-846/rce_0/d-link%20dir-846%20rce.md	Trust: 2.4
url:	https://github.com/pagalaxylab/vulinfo/blob/master/d-link%20dir-846%20rce.md	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2018-16408	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16408	Trust: 0.8

sources: CNVD: CNVD-2019-02396 // VULHUB: VHN-126764 // JVNDB: JVNDB-2018-009640 // CNNVD: CNNVD-201809-095 // NVD: CVE-2018-16408

SOURCES

db:	CNVD	id:	CNVD-2019-02396
db:	VULHUB	id:	VHN-126764
db:	JVNDB	id:	JVNDB-2018-009640
db:	CNNVD	id:	CNNVD-201809-095
db:	NVD	id:	CVE-2018-16408

LAST UPDATE DATE

2024-11-23T22:58:51.527000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-02396	date:	2019-01-22T00:00:00
db:	VULHUB	id:	VHN-126764	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2018-009640	date:	2018-11-22T00:00:00
db:	CNNVD	id:	CNNVD-201809-095	date:	2020-10-22T00:00:00
db:	NVD	id:	CVE-2018-16408	date:	2024-11-21T03:52:41.530

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2019-02396	date:	2019-01-22T00:00:00
db:	VULHUB	id:	VHN-126764	date:	2018-09-03T00:00:00
db:	JVNDB	id:	JVNDB-2018-009640	date:	2018-11-22T00:00:00
db:	CNNVD	id:	CNNVD-201809-095	date:	2018-09-04T00:00:00
db:	NVD	id:	CVE-2018-16408	date:	2018-09-03T19:29:01.120