CVE-2019-7297 | BDVDB-2026-112374 Detail

Description#

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system function with an untrusted input parameter named Address. Consequently, an attacker can execute any command remotely when they control this input.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/leonW7/D-Link/blob/master/Vul_1.md
http://www.securityfocus.com/bid/106815

Exploit#

No public exploit known

History#

Version 12019-01-31Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.