CVE-2019-8314: OS Command Injection
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8314?
The severity of CVE-2019-8314 is critical with a score of 8.8.
How does CVE-2019-8314 impact D-Link DIR-878 devices?
CVE-2019-8314 allows a remote attacker to execute arbitrary code and get a root shell on D-Link DIR-878 devices.
Which firmware versions of D-Link DIR-878 are affected by CVE-2019-8314?
D-Link DIR-878 devices with firmware version 1.12A1 are affected by CVE-2019-8314.
What is a Command Injection vulnerability?
A Command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
Is D-Link DIR-878 device vulnerable to CVE-2019-8314?
Yes, D-Link DIR-878 devices are vulnerable to CVE-2019-8314.