CVE-2018-6530criticalunder attackransomwareCWE-78

CVE-2018-6530

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weaponsame day
Published on NVDMar 6
1st PoCMar 2
CISA KEV+1647d
Action required by CISAfederal deadline: 2022-09-29

The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

In short

A vulnerability in the soap.cgi web interface of several D-Link routers allows attackers to execute arbitrary commands on the device by sending specially crafted requests. This can give attackers complete control over your router.

Technical detail

OS command injection in soap.cgi (soapcgi_main function) allows unauthenticated remote attackers to execute arbitrary OS commands via unsanitized input in the 'service' parameter. The vulnerability affects multiple D-Link router models (DIR-880L, DIR-868L, DIR-865L, DIR-860L) and requires only network access to the affected device's web interface.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.