CVE-2019-7297
Last modified
CVE-2019-7297 is a vulnerability of currently unknown severity. An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. EPSS estimates a 12.46% chance of exploitation in the next 30 days.
Description
An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system function with an untrusted input parameter named Address. Consequently, an attacker can execute any command remotely when they control this input.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| D-Link | Dir-823g Firmware | <= 1.02b03 |
References
- http://www.securityfocus.com/bid/106815Third Party Advisory
- https://github.com/leonW7/D-Link/blob/master/Vul_1.mdExploit, Third Party Advisory
- http://www.securityfocus.com/bid/106815Third Party Advisory
- https://github.com/leonW7/D-Link/blob/master/Vul_1.mdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-7297?
How severe is CVE-2019-7297?
How do I fix CVE-2019-7297?
Are you affected by CVE-2019-7297?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST