Command injection

2021-11-0410:15:00

PRIOn knowledge base

www.prio-n.com

9.7 High

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.8%

JSON

A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the Captcha field to Login.

CPENameOperatorVersion
dir-823g_firmwareeq1.0.2-b5

CPE	Name	Operator	Version
	dir-823g_firmware	eq	1.0.2-b5

References

d-link.com

github.com/sek1th/iot/blob/master/dir823g_3.md

www.dlink.com/en/security-bulletin/