CVE-2018-19300: Input Validation
First published: Thu Apr 11 2019(Updated: )
On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) before firmware version 2.04b01, DWR-921 (A1) before firmware version 1.02b01, and DWR-921 (B1) before firmware version 2.03b01, there exists an EXCU_SHELL file in the web directory. By sending a GET request with specially crafted headers to the /EXCU_SHELL URI, an attacker could execute arbitrary shell commands in the root context on the affected device. Other devices might be affected as well.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| D-Link DAP-1530 | <=1.05 | |
| D-Link DAP-1530 | ||
| D-Link DAP-1610 | <=1.05 | |
| D-Link DAP-1610 | ||
| D-Link DWR-111 Firmware | <=1.01 | |
| dlink DWR-111 firmware | ||
| D-Link DWR-116 Firmware | =1.06-b1 | |
| D-Link DWR-116 Firmware | =1.06-b2 | |
| D-Link DWR-116 Firmware | <=1.05 | |
| D-Link DWR-116 | ||
| D-Link DWR-512 Firmware | <=2.02 | |
| D-Link DWR-512 | ||
| dlink DWR-711 | <=1.11 | |
| D-Link DWR-711 | ||
| D-Link DWR-712 firmware | <=2.02 | |
| D-Link DWR-712 firmware | ||
| D-Link DWR-921 Firmware | <=1.02 | |
| D-Link DWR-921 | ||
| D-Link DWR-921 Firmware | <=2.02 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://community.greenbone.net/t/cve-2018-19300-remote-command-execution-vulnerability-in-d-link-dwr-and-dap-routers/1772
- https://eu.dlink.com/de/de/support/support-news/2019/march/19/remote-command-execution-vulnerability-in-d-link-dwr-and-dap-routers
- https://www.greenbone.net/en/serious-vulnerability-discovered-in-d-link-routers/
- https://www.greenbone.net/schwerwiegende-sicherheitsluecke-in-d-link-routern-entdeckt/
Frequently Asked Questions
What is the severity of CVE-2018-19300?
CVE-2018-19300 is classified as a remote command execution vulnerability that poses a high risk to affected D-Link devices.
How do I fix CVE-2018-19300?
To fix CVE-2018-19300, update the affected D-Link firmware to the latest version provided by the manufacturer.
Which D-Link devices are affected by CVE-2018-19300?
CVE-2018-19300 affects D-Link DAP-1530, DAP-1610, DWR-111, DWR-116, DWR-512, DWR-711, and DWR-712 devices among others.
Can CVE-2018-19300 be exploited remotely?
Yes, CVE-2018-19300 can be exploited remotely, allowing attackers to execute arbitrary commands on the affected devices.
Is there a patch available for CVE-2018-19300?
Yes, D-Link has released patches for CVE-2018-19300 in firmware updates that must be applied to vulnerable devices.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/description
- agent/weakness
- agent/severity
- agent/author
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/d-link
- canonical/d-link dap-1530
- version/d-link dap-1530/1.05
- vendor/dlink
- canonical/d-link dap-1610
- version/d-link dap-1610/1.05
- canonical/d-link dwr-111 firmware
- version/d-link dwr-111 firmware/1.01
- canonical/dlink dwr-111 firmware
- canonical/d-link dwr-116 firmware
- version/d-link dwr-116 firmware/1.06-b1
- version/d-link dwr-116 firmware/1.06-b2
- version/d-link dwr-116 firmware/1.05
- canonical/d-link dwr-116
- canonical/d-link dwr-512 firmware
- version/d-link dwr-512 firmware/2.02
- canonical/d-link dwr-512
- canonical/dlink dwr-711
- version/dlink dwr-711/1.11
- canonical/d-link dwr-711
- canonical/d-link dwr-712 firmware
- version/d-link dwr-712 firmware/2.02
- canonical/d-link dwr-921 firmware
- version/d-link dwr-921 firmware/1.02
- canonical/d-link dwr-921
- version/d-link dwr-921 firmware/2.02