1. Home
  2. CVE Database
  3. CVE-2013-7471
CRITICAL · 9.8

CVE-2013-7471

An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Inject...

Vulnerability Description

An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
DlinkDir-300 Firmware2.14b01
DlinkDir-300b
DlinkDir-600 Firmware< 2.17b01
DlinkDir-600-
DlinkDir-645 Firmware< 1.04b11
DlinkDir-645-
DlinkDir-845 Firmware< 1.02b03
DlinkDir-845-
DlinkDir-865 Firmware1.05b03
DlinkDir-865-

Related Weaknesses (CWE)

CWE-77

References

FAQ

What is CVE-2013-7471?

CVE-2013-7471 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Inject...

How severe is CVE-2013-7471?

CVE-2013-7471 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2013-7471?

Check the references section above for vendor advisories and patch information. Affected products include: Dlink Dir-300 Firmware, Dlink Dir-300, Dlink Dir-600 Firmware, Dlink Dir-600, Dlink Dir-645 Firmware.