CVE-2019-15526: OS Command Injection
First published: Fri Aug 23 2019(Updated: )
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings, a related issue to CVE-2019-13482.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dlink Dir-823g Firmware | =1.0.2b05 | |
| Dlink Dir-823g |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2019-15526?
CVE-2019-15526 is a vulnerability discovered on D-Link DIR-823G devices with firmware V1.0.2B05 that allows command injection via shell metacharacters in the Type field to SetWanSettings.
How severe is CVE-2019-15526?
CVE-2019-15526 has a severity rating of 8.8 (Critical).
What is the affected software and version of CVE-2019-15526?
The affected software is D-Link DIR-823G devices with firmware V1.0.2B05.
How can the CVE-2019-15526 vulnerability be exploited?
CVE-2019-15526 can be exploited with authentication by using shell metacharacters in the Type field to SetWanSettings via HNAP1.
Is there any fix or patch available for CVE-2019-15526?
As of now, there is no official fix or patch available for CVE-2019-15526. It is recommended to update the firmware of affected devices if a patch becomes available.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/dlink
- canonical/dlink dir-823g firmware
- version/dlink dir-823g firmware/1.0.2b05
- canonical/dlink dir-823g