D-Link DSL-2750B Devices < 1.05 Command Injection (CVE-2016-20017)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(241512);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/08");

  script_cve_id("CVE-2016-20017");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/01/29");

  script_name(english:"D-Link DSL-2750B Devices < 1.05 Command Injection (CVE-2016-20017)");

  script_set_attribute(attribute:"synopsis", value:
"The remote router is affected by a command injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as
exploited in the wild in 2016 through 2022.

Note that Nessus has not tested for this issue but has instead relied only on the router's self-reported model.");
  # https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8954cd55");
  script_set_attribute(attribute:"solution", value:
"Upgrade to a supported device.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-20017");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/10/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/10/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/08");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:d-link:dsl-2750b");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("d-link_router_detect.nasl");
  script_require_keys("installed_sw/D-Link Routers");
  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'D-Link Routers');

if (app_info.Model != 'DSL-2750B')
  audit(AUDIT_HOST_NOT, 'the affected D-Link router model');

var constraints = [
  { 'fixed_version' : '1.0.5' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);