CVE-2018-19987

🗓️ 13 May 2019 13:23:33Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 98 Views🌐 WEB

D-Link devices vulnerable to command injection via IsAccessPoint parameter mishandling.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	SetAccessPointMode.php Arbitrary Command Execution	19 May 202300:00	–	bdu_fstec
Cvelist	CVE-2018-19987	13 May 201913:23	–	cvelist
Kitploit	blogpost_cve-2018-19987-analysis	1 Nov 202603:19	–	kitploit
NVD	CVE-2018-19987	13 May 201914:29	–	nvd
OpenVAS	D-Link DIR-822 Multiple Vulnerabilities (2018 - 2024)	24 Jun 202500:00	–	openvas
OpenVAS	D-Link DIR-860L Multiple Vulnerabilities (2018 - 2025)	24 Jun 202500:00	–	openvas
osv_cve	CVE-2018-19987	13 May 201914:29	–	osv_cve
Prion	Command injection	13 May 201914:29	–	prion
Positive Technologies	PT-2019-6342 · D Link · Dir-860L +4	7 Jan 201900:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2018-19987: Improper Neutralization of Special Elements used in an OS Command	13 May 201900:00	–	rapid7

NVD

Node

AND

Node

AND

Node

AND

Node

AND

Node

AND

d-link dir-880l_firmwareMatch1.20b01_01_i3sebeta

Node

AND

Source	Link
github	www.github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990

Parameter	Position	Path	Description	CWE
IsAccessPoint	nested	/HNAP1/SetAccessPointMode	The IsAccessPoint parameter in the /HNAP1/SetAccessPointMode XML message is saved to a script file without regex checking, leading to command injection when the script is executed.	CWE-78

17 Jun 2026 01:50Current

9.7Critical risk

Vulners AI Score9.7

CVSS 39.8

CVSS 210

EPSS0.1204