CVE-2018-19300

On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) before firmware version 2.04b01, DWR-921 (A1) before firmware version 1.02b01, and DWR-921 (B1) before firmware version 2.03b01, there exists an EXCU_SHELL file in the web directory. By sending a GET request with specially crafted headers to the /EXCU_SHELL URI, an attacker could execute arbitrary shell commands in the root context on the affected device. Other devices might be affected as well.

• CWE-20

• https://community.greenbone.net/t/cve-2018-19300-remote-command-execution-vulnerability-in-d-link-dwr-and-dap-routers/1772Exploit, Third Party Advisory
• https://eu.dlink.com/de/de/support/support-news/2019/march/19/remote-command-execution-vulnerability-in-d-link-dwr-and-dap-routersVendor Advisory
• https://www.greenbone.net/en/serious-vulnerability-discovered-in-d-link-routers/Third Party Advisory
• https://www.greenbone.net/schwerwiegende-sicherheitsluecke-in-d-link-routern-entdeckt/Third Party Advisory
• https://community.greenbone.net/t/cve-2018-19300-remote-command-execution-vulnerability-in-d-link-dwr-and-dap-routers/1772Exploit, Third Party Advisory
• https://eu.dlink.com/de/de/support/support-news/2019/march/19/remote-command-execution-vulnerability-in-d-link-dwr-and-dap-routersVendor Advisory
• https://www.greenbone.net/en/serious-vulnerability-discovered-in-d-link-routers/Third Party Advisory
• https://www.greenbone.net/schwerwiegende-sicherheitsluecke-in-d-link-routern-entdeckt/Third Party Advisory

Published

Apr 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19289An issue was discovered in Valine v1.3.3. It allows HTML inj…6.1
• CVE-2018-1929IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6…4.3
• CVE-2018-19290In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax sy…
• CVE-2018-19291An issue was discovered in DiliCMS 2.4.0. There is a CSRF vu…
• CVE-2018-19295Sylabs Singularity 2.4 to 2.6 allows local users to conduct …
• CVE-2018-19296PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable t…8.8
• CVE-2018-19301tp4a TELEPORT 3.1.0 allows XSS via the login page because a …
• CVE-2018-19311Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via th…
• CVE-2018-19312Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2…
• CVE-2018-19318SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=up…
• CVE-2018-19319SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=upda…
• CVE-2018-1932IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vul…4.9