CVE-2022-50596: falha crítica em D-Link DIR-1260
D-Link DIR-1260 <= v1.20B05 GetDeviceSettings Unauthenticated Command Injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 4.0%
D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within the SetDest/Dest/Target arguments to the GetDeviceSettings form. The management interface is accessible over HTTP and HTTPS on the local and Wi-Fi networks and optionally from the Internet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
D-Link · DIR-1260CVEs relacionadas — D-Link DIR-1260
No mesmo produto, das mais perigosas para as menos.
Referências
https://blog.exodusintel.com/2022/05/11/d-link-dir-1260-getdevicesettings-pre-auth-command-injection-vulnerability/https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10298https://www.vulncheck.com/advisories/dlink-dir1260-getdevicesettings-unauthenticated-command-injection