CVE-2018-10823

high-risk
Published 2018-10-17

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.

Do I need to act?

!
94.0% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
45676
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Dlink

References (4)

Exploit http://sploit.tech/2018/10/12/D-Link.html
Exploit https://seclists.org/fulldisclosure/2018/Oct/36
Exploit http://sploit.tech/2018/10/12/D-Link.html
Exploit https://seclists.org/fulldisclosure/2018/Oct/36
60
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 20/34 · Moderate
Exposure 10/34 · Low