The vulnerability of the UpdateSite function in the software controller for centralized control of wireless networks by D-Link Central WiFi Manager allows a intruder to inject any arbitrary code into the uploaded web page.

🗓️ 10 Jan 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

UpdateSite in D-Link Central WiFi Manager enables remote arbitrary code injection into uploaded pages due to weak protection.

Reporter	Title	Published	Views	Family All 14
0day.today	D-Link Central WiFiManager Software Controller Code Execution / XSS Exploit	5 Oct 201800:00	–	zdt
Circl	CVE-2018-17443	5 Oct 201800:00	–	circl
CNVD	D-Link Central WiFi Manager Cross-Site Scripting Vulnerability (CNVD-2018-20464)	10 Oct 201800:00	–	cnvd
Core Security	D-Link Central WiFiManager Software Controller Multiple Vulnerabilities	4 Oct 201800:00	–	coresecurity
Check Point Advisories	D-Link Central WiFiManager Cross-Site Scripting (CVE-2018-17441; CVE-2018-17443)	8 Oct 201800:00	–	checkpoint_advisories
CVE	CVE-2018-17443	8 Oct 201816:00	–	cve
Cvelist	CVE-2018-17443	8 Oct 201816:00	–	cvelist
Exploit DB	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	5 Oct 201800:00	–	exploitdb
exploitpack	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	5 Oct 201800:00	–	exploitpack
NVD	CVE-2018-17443	8 Oct 201816:29	–	nvd

Vulners

Node

d-link central_wifi_managerRange<1.03r0100-beta1

Source	Link
cxsecurity	www.cxsecurity.com/cveshow/CVE-2018-17443/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-17443
vuldb	www.vuldb.com/
seclists	www.seclists.org/fulldisclosure/2018/Oct/11
exploit-db	www.exploit-db.com/exploits/45533
web	www.web.nvd.nist.gov/view/vuln/detail
exploit-db	www.exploit-db.com/exploits/45533/

23 Mar 2021 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 25.8

CVSS 36.1

EPSS0.05657

update site vulnerability remote code injection uploaded pages protection dlink central wifi