Log in Start free

Actively exploited · Published Mar 6, 2018 · Assigned by mitre

CVE-2018-6530

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity OS command injection in Multiple Routers from D-Link. Attackers are actively exploiting it in the wild (listed by CISA on September 8, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 96.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)96.7%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Sep 8, 2022
Attack tooling1Nuclei

CISA guidance

The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

Federal agencies must remediate by Sep 29, 2022.

Official description

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References