CVE-2019-17509: OS Command Injection

Published Oct 11, 2019

Updated

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php.

Affected Software

2 affected components

Dlink Dir-846 Firmware=100a35

Dlink Dir-846

Event History

Oct 11, 2019

CVE Published

via MITRE·07:29 PM

Data Sourced

via MITRE·07:29 PM

Description

Frequently Asked Questions

What is the severity of CVE-2019-17509?

The severity of CVE-2019-17509 is critical with a CVSS score of 9.8.

How can remote attackers exploit CVE-2019-17509?

Remote attackers can exploit CVE-2019-17509 by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters.

What is the affected firmware version for D-Link DIR-846 devices?

D-Link DIR-846 devices with firmware version 100A35 are affected by CVE-2019-17509.

How can I fix CVE-2019-17509?

There is no official fix available for CVE-2019-17509 at the moment. It is recommended to update to the latest firmware when it becomes available.

Is D-Link DIR-846 vulnerable to CVE-2019-17509?

D-Link DIR-846 devices are vulnerable to CVE-2019-17509 if they are running firmware version 100A35.