CVE-2018-25120: D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test
D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/MailTest' and uses several form parameters directly in a call to a system email utility without proper input validation. An unauthenticated remote attacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The DNS-343 product line has been declared end-of-life.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25120?
CVE-2018-25120 is classified as a high severity vulnerability due to its command injection potential.
How do I fix CVE-2018-25120?
To remediate CVE-2018-25120, update the D-Link DNS-343 ShareCenter firmware to the latest version that addresses this vulnerability.
What devices are affected by CVE-2018-25120?
CVE-2018-25120 affects D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05.
What kind of attack can be executed due to CVE-2018-25120?
CVE-2018-25120 allows attackers to perform command injection attacks via the Mail Test functionality.
Is there a workaround for CVE-2018-25120?
Temporary workarounds for CVE-2018-25120 may involve disabling the Mail Test feature if updating the firmware is not immediately possible.