CVE-2018-19986

🗓️ 13 May 2019 13:22:05Reported by mitreType

cve🔗 web.nvd.nist.gov👁 115 Views🌐 WEB

CVE-2018-19986 vulnerability in D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices, allows shell metacharacters in RemotePort parameter

Reporter	Title	Published	Views	Family All 25
BDU FSTEC	The vulnerability of the SetQoSSettings.php script in D-Link DIR-822 router software allows a hacker to execute arbitrary commands.	17 May 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SetWiFiVerifyAlpha.php script in D-Link DIR-822 router software allows a hacker to influence the integrity, availability, and confidentiality of the protected information.	17 May 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SetRouterSettings.php script in D-Link DIR-818LW Rev.A and DIR-822 B1 router microprogramming systems allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	19 May 202300:00	–	bdu_fstec
Circl	CVE-2018-19986	17 Aug 202211:00	–	circl
Check Point Advisories	D-Link DIR-818LW Command Injection (CVE-2018-19986)	11 Aug 202200:00	–	checkpoint_advisories
Cvelist	CVE-2018-19986	13 May 201913:22	–	cvelist
NVD	CVE-2018-19986	13 May 201914:29	–	nvd
OpenVAS	D-Link DIR-822 Multiple Vulnerabilities (2018 - 2024)	24 Jun 202500:00	–	openvas
OSV	CVE-2018-19986	13 May 201914:29	–	osv
OSV	CVE-2018-19987	13 May 201914:29	–	osv

NVD

Node

AND

Node

AND

Source	Link
github	www.github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990

Parameter	Position	Path	Description	CWE
RemotePort	request body	/HNAP1/SetRouterSettings	RemotePort parameter in /HNAP1/SetRouterSettings is saved to internal configuration memory and later used in iptables commands without regex validation, allowing shell metacharacters in the value (e.g., telnetd) to execute arbitrary commands.	CWE-78

17 Jun 2026 01:50Current

9.5High risk

Vulners AI Score9.5

CVSS 39.8

CVSS 210

EPSS0.41606