Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2013-1599

CWE-78 — OS Command InjectionCWE-416 — Use After Free12 documents8 sources
Severity
9.8CRITICAL
EPSS
92.3%
top 0.28%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
17
Dlink Dcs-1100 FirmwareDlink Dcs-1100l FirmwareDlink Dcs-1130 Firmware+14 more
Timeline
PublishedJan 28
Latest updateMay 5

Description

A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages17 packages

▶NVDdlink/dcs-1100_firmware1.03, 1.04+1
▶NVDdlink/dcs-1130_firmware1.03, 1.04+1

🔴Vulnerability Details

3
GHSA
GHSA-fwq8-q6c7-f4w8: A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd↗2022-05-05
▶
CVEList
CVE-2013-1599: A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd↗2020-01-28
▶
VulnCheck
D-Link dcs-3411_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')↗2013
▶

💥Exploits & PoCs

1
Exploit-DB
D-Link IP Cameras - Multiple Vulnerabilities↗2013-05-01
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1599)↗2014-11-25
▶

📋Vendor Advisories

3
Red Hat
webkitgtk: use-after-free in the HTMLFormElement::prepareForSubmission() (WSA-2015-0001)↗2015-01-26
▶
Red Hat
icu: use-after-free flaw leads to denial of service↗2013-10-01
▶
Red Hat
v8: remote denial of service via memory corruption↗2013-10-01
▶

💬Community

2
Bugzilla
CVE-2013-2927 webkitgtk: use-after-free in the HTMLFormElement::prepareForSubmission() (WSA-2015-0001)↗2015-01-27
▶
Bugzilla
CVE-2013-2919 v8: remote denial of service via memory corruption↗2013-10-03
▶