CVE-2019-20217: OS Command Injection

Published Jan 29, 2020

Updated

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVERID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.

Affected Software

3 affected components

dlink Dir-859 Firmware=1.05

dlink Dir-859 Firmware=1.06b01-beta01

Dlink Dir-859

Remediation

Patch Available

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147

Event History

Jan 29, 2020

CVE Published

via MITRE·02:32 AM

Data Sourced

via MITRE·02:32 AM

Description

Frequently Asked Questions

What is the severity of CVE-2019-20217?

The severity of CVE-2019-20217 is critical with a severity value of 9.8.

How can remote attackers exploit CVE-2019-20217?

Remote attackers can exploit CVE-2019-20217 by executing arbitrary OS commands via the urn: in the M-SEARCH method in ssdpcgi() in /htdocs/cgibin.

Which devices are affected by CVE-2019-20217?

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices are affected by CVE-2019-20217.

How can I fix CVE-2019-20217?

To fix CVE-2019-20217, update the firmware of D-Link DIR-859 devices to version 1.07 or later.

Is there any additional information available for CVE-2019-20217?

Yes, you can find additional information about CVE-2019-20217 in the provided references.