CVE-2019-20215

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because HTTPST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker t...

DLink DIR-859 1.05 & 1.06B01 Multiple Vulnerabilities (RCE)

The version of DLink installed on the remote host is prior to 1.07b03. It is, therefore, affected by multiple remote code execution vulnerabilities as referenced in the vendor advisory. - The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an...

D-Link DIR-859 Remote Code Execution (CVE-2019-20215)

A remote code execution vulnerability exists in D-Link DIR-859. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi', 'Description' = %q D-Link Devices Unauthenticated Remote Command Execution i...

D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi', 'Description' = %q D-Link Devices Unauthenticated Remote Command Execution i...

D-Link ssdpcgi Unauthenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi', 'Description' = %q D-Link Devices Unauthenticated Remote Command Execution i...

CVE-2019-20215

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because HTTPST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker t...

CVE-2019-20215

CVE-2019-20215 affects D-Link DIR-859 firmware 1.05 and 1.06B01 Beta01. It is a remote code execution vulnerability in the ssdpcgi() M-SEARCH handling, where the urn: service/device string is checked via strstr, enabling an attacker to append arbitrary shell commands. Related entries note additio...

D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi

D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi. Module Options msf use exploit/linux/upnp/dlink/dir859execssdpcgi msf undefineddir859execssdpcgi show actions ...actions... msf undefineddir859execssdpcgi set ACTION msf undefineddir859execssdpcgi show options ...show and set...

CVE-2019-20215

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/upnp/dlinkupnpmsearchexec.rb 2020-02-05 19:28:22+00:00| seen|...