CVE-2013-1599
published 2020-01-28CVE-2013-1599: A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01…
PriorityP188critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
40.35%
98.5th percentile
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dcs-1100_firmware | — | — |
| dlink | dcs-1100_firmware | — | — |
| dlink | dcs-1100l_firmware | — | — |
| dlink | dcs-1130_firmware | — | — |
| dlink | dcs-1130_firmware | — | — |
| dlink | dcs-1130l_firmware | — | — |
| dlink | dcs-2102_firmware | — | — |
| dlink | dcs-2121_firmware | — | — |
| dlink | dcs-3410_firmware | — | — |
| dlink | dcs-3411_firmware | — | — |
| dlink | dcs-3430_firmware | — | — |
| dlink | dcs-5230_firmware | — | — |
| dlink | dcs-5230l_firmware | — | — |
| dlink | dcs-5605_firmware | — | — |
| dlink | dcs-5635_firmware | — | — |
| dlink | dcs-6410_firmware | — | — |
| dlink | dcs-7410_firmware | — | — |
| dlink | dcs-7510_firmware | — | — |
| dlink | wcs-1100_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/cgi-bin/rtpd.cgi
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1599)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cgi-bin/rtpd.cgi?"; fast_pattern; reference:url,www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities; classtype:attempted-admin; sid:2019801; rev:4; metadata:created_at 2014_11_25, cve CVE_2013_1599, signature_severity Major, updated_at 2020_09_28;)
- →The vulnerable script uses 'eval' on user-supplied QUERY_STRING after replacing '&' with spaces via sed, enabling command injection without spaces by using '&' as a delimiter between command arguments. ↗
- →Exploit payloads will appear in the URI as GET requests to /cgi-bin/rtpd.cgi? with shell metacharacters (semicolons, ampersands) substituting for spaces — monitor HTTP GET requests to this endpoint for such patterns. ↗
- →No authentication is required to reach the vulnerable endpoint; any unauthenticated GET to /cgi-bin/rtpd.cgi? should be treated as suspicious on D-Link IP camera devices. ↗
- →The injection bypasses the space-check by encoding spaces as '&' characters in the query string; detection should look for shell commands with '&' separating arguments (e.g., 'cmd&arg') in the query string of requests to rtpd.cgi. ↗
- ·The Snort/Suricata rule (ET sid:2019801) triggers on any GET to /cgi-bin/rtpd.cgi? regardless of payload content; tune to reduce false positives if legitimate camera management traffic uses this endpoint. ↗
- ·The advisory notes 'Other SKUs are probably affected too, but they were not checked' — the confirmed affected firmware versions listed are not exhaustive. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fwq8-q6c7-f4w8: A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd
ghsa_unreviewed·2022-05-05
CVE-2013-1599 [HIGH] CWE-78 GHSA-fwq8-q6c7-f4w8: A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera?s web interface.
VulnCheck
D-Link dcs-3411_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2013·CVSS 9.8
CVE-2013-1599 [CRITICAL] D-Link dcs-3411_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
D-Link dcs-3411_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface.
Affected: D-Link dcs-3411_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://unit
Red Hat
webkitgtk: use-after-free in the HTMLFormElement::prepareForSubmission() (WSA-2015-0001)
vendor_redhat·2015-01-26·CVSS 6.8
CVE-2013-2927 [MEDIUM] CWE-416 webkitgtk: use-after-free in the HTMLFormElement::prepareForSubmission() (WSA-2015-0001)
webkitgtk: use-after-free in the HTMLFormElement::prepareForSubmission() (WSA-2015-0001)
Use-after-free vulnerability in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink, as used in Google Chrome before 30.0.1599.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to submission for FORM elements.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Will not fix
Package: webkitgtk3 (Red Ha
Red Hat
icu: use-after-free flaw leads to denial of service
vendor_redhat·2013-10-01·CVSS 7.5
CVE-2013-2924 [HIGH] CWE-416 icu: use-after-free flaw leads to denial of service
icu: use-after-free flaw leads to denial of service
Use-after-free vulnerability in International Components for Unicode (ICU), as used in Google Chrome before 30.0.1599.66 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Package: icu (Red Hat Directory Server 8) - Will not fix
Package: icu (Red Hat Enterprise Linux 5) - Will not fix
Package: icu (Red Hat Enterprise Linux 6) - Will not fix
Package: icu (Red Hat Enterprise Linux 7) - Not affected
Red Hat
v8: remote denial of service via memory corruption
vendor_redhat·2013-10-01·CVSS 7.5
CVE-2013-2919 [HIGH] v8: remote denial of service via memory corruption
v8: remote denial of service via memory corruption
Google V8, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Package: ruby193-v8 (OpenShift Enterprise 1) - Not affected
Package: ruby193-v8 (Red Hat OpenStack Platform 3) - Not affected
Package: v8 (Red Hat OpenStack Platform 3) - Not affected
Package: v8 (Red Hat Satellite 6) - Not affected
Package: v8314-v8 (Red Hat Software Collections) - Not affected
Package: ruby193-v8 (Red Hat Subscription Asset Manager) - Not affected
Package: v8 (Red Hat Subscription Asset Manager) - Not affected
Suricata
ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1599)
suricata·2014-11-25·CVSS 9.8
CVE-2013-1599 [CRITICAL] ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1599)
ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1599)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1599)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cgi-bin/rtpd.cgi?"; fast_pattern; reference:url,www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities; classtype:attempted-admin; sid:2019801; rev:4; metadata:created_at 2014_11_25, cve CVE_2013_1599, signature_severity Major, updated_at 2020_09_28;)
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
CVE-2020-28188 [HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
# Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020. Several newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, have emerged and were continuously being exploited in the wild as of late 2020 to early 2021.
This blog provides details of the newly observed exploits as well as a dive deep into the exploitation analysis, vendor analysis, attack origin, and attack category distribution.
Palo Alto Networks Next-Generation Firewall customers are protected from these attacks with the URL Filtering an
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
[HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (November 2020-January 2021)
Lei Xu
Yue Guan
Vaibhav Singhal
Published: April 12, 2021
Malware
Trend Reports
Vulnerabilities
Botnet
DDoS
Exploit kit
IoT
Network security trends
## Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020 . Several newly observed exploits, including CVE-2020-28188 , CVE-2020-17519 , and CVE-2020-29227 , have emerged and were continuously being exploited in the wild as of late 2020 to earl
Bugzilla
CVE-2013-2927 webkitgtk: use-after-free in the HTMLFormElement::prepareForSubmission() (WSA-2015-0001)
bugzilla·2015-01-27·CVSS 6.8
CVE-2013-2927 [MEDIUM] CVE-2013-2927 webkitgtk: use-after-free in the HTMLFormElement::prepareForSubmission() (WSA-2015-0001)
CVE-2013-2927 webkitgtk: use-after-free in the HTMLFormElement::prepareForSubmission() (WSA-2015-0001)
Following vulnerability was discovered on the 2.4 stable series of WebKitGTK+:
CVE-2013-2927
Use-after-free vulnerability in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink, as used in Google Chrome before 30.0.1599.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to submission for FORM elements.
External References:
http://webkitgtk.org/security/WSA-2015-0001.html
Discussion:
Created webkitgtk4 tracking bugs for this issue:
Affects: fedora-all [bug 1186276]
---
Created webkitgtk3 tracking bugs for this issue:
Affects: fedora-all [bug 1181092]
---
Statement:
Red
Bugzilla
CVE-2013-2919 v8: remote denial of service via memory corruption
bugzilla·2013-10-03·CVSS 7.5
CVE-2013-2919 [HIGH] CVE-2013-2919 v8: remote denial of service via memory corruption
CVE-2013-2919 v8: remote denial of service via memory corruption
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-2919 to
the following vulnerability:
Name: CVE-2013-2919
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2919
Assigned: 20130411
Reference: http://googlechromereleases.blogspot.com/2013/10/stable-channel-update.html
Reference: https://code.google.com/p/chromium/issues/detail?id=282736
Google V8, as used in Google Chrome before 30.0.1599.66, allows remote
attackers to cause a denial of service (memory corruption) or possibly
have unspecified other impact via unknown vectors.
Discussion:
Any indication this affects the stable v8 3.14 series we're shipping in Fedora?
The upstream patch seems to be here:
https://code.google.com/p/v8/source/deta
http://www.exploit-db.com/exploits/25138http://www.securityfocus.com/bid/59564https://exchange.xforce.ibmcloud.com/vulnerabilities/83941https://packetstormsecurity.com/files/cve/CVE-2013-1599https://seclists.org/fulldisclosure/2013/Apr/253https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilitieshttp://www.exploit-db.com/exploits/25138http://www.securityfocus.com/bid/59564https://exchange.xforce.ibmcloud.com/vulnerabilities/83941https://packetstormsecurity.com/files/cve/CVE-2013-1599https://seclists.org/fulldisclosure/2013/Apr/253https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities
2020-01-28
Published
Exploited in the wild