CVE-2021-28144

HIGH

8.8

Beschreibung

prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht3/11/2021

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

dlink:dir-3060dlink:dir-3060_firmware

Schwachen (CWE)

CWE-78

Referenzen

http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.html(cve@mitre.org)

http://seclists.org/fulldisclosure/2021/Mar/23(cve@mitre.org)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10208(cve@mitre.org)

https://www.iot-inspector.com/blog/advisory-d-link-dir-3060/(cve@mitre.org)

http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.html(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2021/Mar/23(af854a3a-2127-422b-91ae-364da2661108)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10208(af854a3a-2127-422b-91ae-364da2661108)

https://www.iot-inspector.com/blog/advisory-d-link-dir-3060/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.