Description (CNA)
A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| D-Link / DWR-M920 | affected 1.1.0; affected 1.1.1; affected 1.1.2; affected 1.1.3; affected 1.1.4; affected 1.1.5; affected 1.1.6; affected 1.1.7; affected 1.1.8; affected 1.1.9; affected 1.1.10; affected 1.1.11; affected 1.1.12; affected 1.1.13; affected 1.1.14; affected 1.1.15; affected 1.1.16; affected 1.1.17; affected 1.1.18; affected 1.1.19; affected 1.1.20; affected 1.1.21; affected 1.1.22; affected 1.1.23; affected 1.1.24; affected 1.1.25; affected 1.1.26; affected 1.1.27; affected 1.1.28; affected 1.1.29; affected 1.1.30; affected 1.1.31; affected 1.1.32; affected 1.1.33; affected 1.1.34; affected 1.1.35; affected 1.1.36; affected 1.1.37; affected 1.1.38; affected 1.1.39; affected 1.1.40; affected 1.1.41; affected 1.1.42; affected 1.1.43; affected 1.1.44; affected 1.1.45; affected 1.1.46; affected 1.1.47; affected 1.1.48; affected 1.1.49; affected 1.1.50 |
CWE
CWE-77, CWE-74
References
- https://vuldb.com/?id.338577
- https://vuldb.com/?ctiid.338577
- https://vuldb.com/?submit.723555
- https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeQuectel.md
- https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeQuectel.md#poc
- https://www.dlink.com/
ADP enrichment
No English description supplied.
No references supplied.