CVE-2019-7297

{"id": "CVE-2019-7297", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-01-31T22:29:00.203", "references": [{"url": "http://www.securityfocus.com/bid/106815", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/leonW7/D-Link/blob/master/Vul_1.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/106815", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/leonW7/D-Link/blob/master/Vul_1.md", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system function with an untrusted input parameter named Address. Consequently, an attacker can execute any command remotely when they control this input."}, {"lang": "es", "value": "Se ha descubierto un problema en dispositivos D-Link DIR-823G con firmware hasta la versi\u00f3n 1.02B03. Una vulnerabilidad de inyecci\u00f3n de comandos permite que los atacantes ejecuten comandos arbitrarios del sistema operativo mediante metacaracteres shell en una petici\u00f3n /HNAP1 manipulada. Esto ocurre cuando la funci\u00f3n GetNetworkTomographyResult llama a la funci\u00f3n del sistema con un par\u00e1metro de entrada no fiable llamado Address. Como consecuencia, un atacante puede ejecutar cualquier comando de forma remota cuando controla esta entrada."}], "lastModified": "2024-11-21T04:47:57.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:d-link:dir-823g_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "497F7AEB-9FFB-418B-8D92-CDA805D59C95", "versionEndIncluding": "1.02b03"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-823g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "67B980AA-84BE-4D22-B4E7-7B2DBF571B65"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}