Vulnerability · Published Aug 25, 2023 · Assigned by VulDB
CVE-2023-4542D-Link DAR-8000-10 sys1.php os command injection
Medium 6.3
In plain English
A medium-severity OS command injection in DAR-8000-10 from D-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 84.7% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238047. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| D-Link | DAR-8000-10 | 20230809 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://vuldb.com/?id.238047 vdb-entry, technical-description
- https://vuldb.com/?ctiid.238047 signature, permissions-required
- https://github.com/PumpkinBridge/cve/blob/main/rce.md exploit