CVE-2013-7471
published 2019-06-11CVE-2013-7471: An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and…
PriorityP182critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
24.04%
97.6th percentile
An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-300_firmware | — | — |
| dlink | dir-600_firmware | < 2.17b01 | 2.17b01 |
| dlink | dir-645_firmware | < 1.04b11 | 1.04b11 |
| dlink | dir-845_firmware | < 1.02b03 | 1.02b03 |
| dlink | dir-865_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes
|60|
snort
alert http any any -> $HOME_NET any (msg:"ET EXPLOIT D-Link Related Command Injection Attempt Inbound (CVE-2013-7471)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:28; content:"/soap.cgi?service=WANIPConn1"; fast_pattern; http.request_body; content:"|60|"; content:"|60|"; distance:0; reference:cve,2013-7471; reference:url,nvd.nist.gov/vuln/detail/cve-2013-7471; classtype:attempted-admin; sid:2039833; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_11_23, cve CVE_2013_7471, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_27, reviewed_at 2024_10_15, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services;)
- →Exploit arrives as an HTTP POST request to the exact URI path /soap.cgi?service=WANIPConn1 (URI length is exactly 28 bytes).
- →Command injection payload is delivered in the SOAP POST body via the NewInternalClient, NewExternalPort, or NewInternalPort XML elements using shell metacharacters (backtick, 0x60). ↗
- →Detect two occurrences of the backtick byte (0x60) in the HTTP request body; the second must appear at distance:0 from the first, indicating a backtick-wrapped shell command.
- →Traffic direction is inbound to the home/internal network on any port over an established HTTP session to the server.
- ·The Snort/Suricata rule (sid:2039833) uses a fixed URI bsize of 28, matching only the exact string /soap.cgi?service=WANIPConn1. Variants with additional query parameters or URL encoding would evade this rule.
- ·Affected device models span multiple firmware branches; version checks must be per-model (DIR-845 <v1.02b03, DIR-600 <v2.17b01, DIR-645 <v1.04b11, DIR-300 rev. B, DIR-865). ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w6mr-25xf-vppm: An issue was discovered in soap
ghsa_unreviewed·2022-05-05
CVE-2013-7471 [CRITICAL] CWE-77 GHSA-w6mr-25xf-vppm: An issue was discovered in soap
An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.
VulnCheck
D-Link DIR-300 Router Improper Neutralization of Special Elements used in a Command ('Command Injection')
vulncheck·2013·CVSS 9.8
CVE-2013-7471 [CRITICAL] D-Link DIR-300 Router Improper Neutralization of Special Elements used in a Command ('Command Injection')
D-Link DIR-300 Router Improper Neutralization of Special Elements used in a Command ('Command Injection')
An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.
Affected: D-Link DIR-300 Router
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.akamai.com/blog/security/latest-echobot-26-infection-vectors; https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVE
Suricata
ET EXPLOIT D-Link Related Command Injection Attempt Inbound (CVE-2013-7471)
suricata·2022-11-23·CVSS 9.8
CVE-2013-7471 [CRITICAL] ET EXPLOIT D-Link Related Command Injection Attempt Inbound (CVE-2013-7471)
ET EXPLOIT D-Link Related Command Injection Attempt Inbound (CVE-2013-7471)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT D-Link Related Command Injection Attempt Inbound (CVE-2013-7471)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:28; content:"/soap.cgi?service=WANIPConn1"; fast_pattern; http.request_body; content:"|60|"; content:"|60|"; distance:0; reference:cve,2013-7471; reference:url,nvd.nist.gov/vuln/detail/cve-2013-7471; classtype:attempted-admin; sid:2039833; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_11_23, cve CVE_2013_7471, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_27, r
No public exploits indexed.
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
CVE-2020-28188 [HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
# Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020. Several newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, have emerged and were continuously being exploited in the wild as of late 2020 to early 2021.
This blog provides details of the newly observed exploits as well as a dive deep into the exploitation analysis, vendor analysis, attack origin, and attack category distribution.
Palo Alto Networks Next-Generation Firewall customers are protected from these attacks with the URL Filtering an
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
[HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (November 2020-January 2021)
Lei Xu
Yue Guan
Vaibhav Singhal
Published: April 12, 2021
Malware
Trend Reports
Vulnerabilities
Botnet
DDoS
Exploit kit
IoT
Network security trends
## Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020 . Several newly observed exploits, including CVE-2020-28188 , CVE-2020-17519 , and CVE-2020-29227 , have emerged and were continuously being exploited in the wild as of late 2020 to earl
arXiv
A Measurement Study on the (In)security of End-of-Life (EoL) Embedded Devices
arxiv_fulltext·2021-05-29
A Measurement Study on the (In)security of End-of-Life (EoL) Embedded Devices
A Measurement Study on the (In)security of End-of-Life (EoL) Embedded Devices
Dingding Wang
Zhejiang University
China
Muhui Jiang
The Hong Kong Polytechnic University
Zhejiang University
China
Rui Chang
Zhejiang University
China
Yajin Zhou
Zhejiang University
China
Baolei Hou
Zhejiang University
China
Xiapu Luo
The Hong Kong Polytechnic University
China
Lei Wu
Zhejiang University
China
Kui Ren
Zhejiang University
China
## Abstract
Embedded devices are becoming popular. Meanwhile, researchers are actively working on improving the security
of embedded devices.
However, previous work ignores the insecurity caused by a special category of devices, i.e., the End-of-Life (EoL in short) devices.
Once a product becomes End-of-Life, vendors tend to no longer maintain its firmware
2019-06-11
Published
Exploited in the wild