CVE-2023-4542mediumobserved exploitationCWE-78

CVE-2023-4542: medium-severity vulnerability in D-Link DAR-8000-10

D-Link DAR-8000-10 sys1.php os command injection

Published · Updated

Follow this CVE+ Monitor DAR-8000-10

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

92Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 6.3epss 85%
from disclosure to weaponsame day
Published on NVDAug 25
1st PoCAug 9
VulnCheck+390d
A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238047. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
D-Link · DAR-8000-10
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — D-Link DAR-8000-10

In the same product, most dangerous first.

CVE-2023-4711MEDIUMD-Link DAR-8000-10 decodmail.php os command injectionEPSS 6.8%CVE-2024-4699MEDIUMD-Link DAR-8000-10 importhtml.php deserializationEPSS 6.1%