CVE-2019-13373

🗓️ 06 Jul 2019 22:54:48Reported by mitreType

cve🔗 web.nvd.nist.gov👁 288 Views🌐 WEB

An issue discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows for arbitrary SQL execution via /web/Public/Conn.php parameter dbSQL

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the /web/Public/Conn.php component of the software controller for centralized control of wireless networks in D-Link Central WiFi Manager CWM(100) allows a intruder to execute arbitrary code.	9 Oct 201900:00	–	bdu_fstec
Circl	CVE-2019-13373	7 Jul 201901:59	–	circl
CNVD	D-Link Central WiFi Manager (CWM-100) Arbitrary SQL Command Query Vulnerability	8 Jul 201900:00	–	cnvd
Check Point Advisories	D-Link Central WiFiManager CWM-100 SQL Injection (CVE-2019-13373)	14 Nov 202200:00	–	checkpoint_advisories
Cvelist	CVE-2019-13373	6 Jul 201922:54	–	cvelist
Metasploit	D-Link Central WiFiManager SQL injection	15 Feb 202117:42	–	metasploit
NVD	CVE-2019-13373	6 Jul 201923:15	–	nvd
OSV	CVE-2019-13373	6 Jul 201923:15	–	osv
Packet Storm	D-Link Central WiFiManager SQL Injection	31 Aug 202400:00	–	packetstorm
Prion	Input validation	6 Jul 201923:15	–	prion

NVD

Node

dlink central_wifimanagerMatch1.03

AND

microsoft windowsMatch-

Source	Link
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
github	www.github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md
unh3x	www.unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/

Parameter	Position	Path	Description	CWE
dbSQL	request body	/web/Public/Conn.php	SQL injection via Public/Conn.php dbSQL parameter allowing arbitrary SQL execution	CWE-89
dbAction	request body	/web/Public/Conn.php	SQL injection via Public/Conn.php dbSQL parameter allowing arbitrary SQL execution	CWE-89

17 Jun 2026 02:16Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 39.8

EPSS0.68019

CWE-89