CVE-2019-17510: OS Command Injection

Published Oct 11, 2019

Updated

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php.

Affected Software

2 affected components

Dlink Dir-846 Firmware=100a35

Dlink Dir-846

Event History

Oct 11, 2019

CVE Published

via MITRE·07:28 PM

Data Sourced

via MITRE·07:28 PM

Description

Frequently Asked Questions

What is CVE-2019-17510?

CVE-2019-17510 is a vulnerability that allows remote attackers to execute arbitrary OS commands on D-Link DIR-846 devices with firmware version 100A35.

How severe is CVE-2019-17510?

CVE-2019-17510 has a severity rating of 9.8, which is considered critical.

How can remote attackers exploit CVE-2019-17510?

Remote attackers can exploit CVE-2019-17510 by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters.

Which software versions are affected by CVE-2019-17510?

D-Link DIR-846 devices with firmware version 100A35 are affected by CVE-2019-17510.

Is D-Link DIR-846 device without firmware version 100A35 vulnerable to CVE-2019-17510?

No, D-Link DIR-846 devices without firmware version 100A35 are not vulnerable to CVE-2019-17510.