CVE-2021-46319

Опубликовано: 17 фев. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Средний

Описание

Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\ " or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.This vulnerability is due to the fact that CVE-2019-17509 is not fully patched and can be bypassed by using line breaks or backticks on its basis.

Ссылки

https://github.com/doudoudedi/DIR-846_Command_Injection/blob/main/DIR-846_Command_Injection1.md
Exploit
Third Party Advisory
https://www.dlink.com/en/security-bulletin/
Vendor Advisory
https://github.com/doudoudedi/DIR-846_Command_Injection/blob/main/DIR-846_Command_Injection1.md
Exploit
Third Party Advisory
https://www.dlink.com/en/security-bulletin/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:dlink:dir-846_firmware:100a43:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-846:a1:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:dlink:dir-846_firmware:100a53dla:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-846:-:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.16559

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-mq76-pcfx-jm9r

github

почти 4 года назад

BDU:2022-00894