CVE-2017-8408: Command Injection
First published: Tue Jul 02 2019(Updated: )
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dlink Dcs-1130 Firmware | ||
| Dlink Dcs-1130 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2017-8408.
What is the severity of CVE-2017-8408?
The severity of CVE-2017-8408 is critical with a severity value of 9.8.
What software is affected by CVE-2017-8408?
The D-Link DCS-1130 firmware is affected by CVE-2017-8408.
What is the CWE category of CVE-2017-8408?
The CWE category of CVE-2017-8408 is CWE-77.
Are there any references related to CVE-2017-8408?
Yes, there are references related to CVE-2017-8408 available at the following URLs: [https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf](https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf) and [https://seclists.org/bugtraq/2019/Jun/8](https://seclists.org/bugtraq/2019/Jun/8).
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/dlink
- canonical/dlink dcs-1130 firmware
- canonical/dlink dcs-1130