// For flags

CVE-2018-5371

 

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request.

diag_ping.cmd, en dispositivos D-Link DSL-2640U con firmware IM_1.00 and ME_1.00, y dispositivos DSL-2540U con firmware ME_1.00, permite que atacantes remotos autenticados ejecuten comandos arbitrarios del sistema operativo mediante metacaracteres shell en el campo ipaddr de una peticiĆ³n HTTP GET.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-01-12 CVE Reserved
  • 2018-01-12 CVE Published
  • 2024-03-09 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
D-link
Search vendor "D-link"
Dsl-2540u Firmware
Search vendor "D-link" for product "Dsl-2540u Firmware"
me_1.00
Search vendor "D-link" for product "Dsl-2540u Firmware" and version "me_1.00"
-
Affected
in Dlink
Search vendor "Dlink"
Dsl-2540u
Search vendor "Dlink" for product "Dsl-2540u"
--
Safe
D-link
Search vendor "D-link"
Dsl-2640u Firmware
Search vendor "D-link" for product "Dsl-2640u Firmware"
im_1.00
Search vendor "D-link" for product "Dsl-2640u Firmware" and version "im_1.00"
-
Affected
in Dlink
Search vendor "Dlink"
Dsl-2640u
Search vendor "Dlink" for product "Dsl-2640u"
--
Safe
D-link
Search vendor "D-link"
Dsl-2640u Firmware
Search vendor "D-link" for product "Dsl-2640u Firmware"
me_1.00
Search vendor "D-link" for product "Dsl-2640u Firmware" and version "me_1.00"
-
Affected
in Dlink
Search vendor "Dlink"
Dsl-2640u
Search vendor "Dlink" for product "Dsl-2640u"
--
Safe