1. Home
  2. CVE Database
  3. CVE-2018-19987
CRITICAL · 9.8

CVE-2018-19987

D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPo...

Vulnerability Description

D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code, the IsAccessPoint parameter is saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. A vulnerable /HNAP1/SetAccessPointMode XML message could have shell metacharacters in the IsAccessPoint element such as the `telnetd` string.

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
D-LinkDir-818Lw Firmware2.05.b03
DlinkDir-818Lw-
D-LinkDir-822 Firmware202krb06
DlinkDir-822 Firmware3.10b06
DlinkDir-822-
D-LinkDir-860L Firmware2.03.b03
DlinkDir-860L-
D-LinkDir-868L Firmware2.05b02
DlinkDir-868L-
D-LinkDir-880L Firmware1.20b01_01_i3se
DlinkDir-880L-
D-LinkDir-890L\/R Firmware1.21b02
DlinkDir-890L\/R-

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2018-19987?

CVE-2018-19987 is a vulnerability with a CVSS score of 9.8 (CRITICAL). D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPo...

How severe is CVE-2018-19987?

CVE-2018-19987 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-19987?

Check the references section above for vendor advisories and patch information. Affected products include: D-Link Dir-818Lw Firmware, Dlink Dir-818Lw, D-Link Dir-822 Firmware, Dlink Dir-822 Firmware, Dlink Dir-822.