cyfenced.com →

[ CVE-2018-6530 · Published 6 Mar 2018 ]

D-Link Multiple Routers OS Command Injection Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 97%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-09-08
  • Known to be used in ransomware campaigns
  • EPSS: 97% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

CISA: Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 29 Sep 2022): The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References