CVE-2018-10822
published 2018-10-17CVE-2018-10822: Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02…
PriorityP268high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
39.27%
98.4th percentile
Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-140l_firmware | <= 1.02 | — |
| dlink | dir-640l_firmware | <= 1.02 | — |
| dlink | dwr-111_firmware | <= 1.01 | — |
| dlink | dwr-116_firmware | <= 1.06 | — |
| dlink | dwr-512_firmware | <= 2.02 | — |
| dlink | dwr-712_firmware | <= 2.02 | — |
| dlink | dwr-912_firmware | <= 2.02 | — |
| dlink | dwr-921_firmware | <= 2.02 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring HTTP GET requests containing '/uir//' or '/uir/..' in the URI path, which are the two traversal patterns used in this CVE. ↗
- →A successful exploit response to GET /uir//etc/passwd will contain the string matching 'root:.*:0:0:' in the HTTP response body — use this as a confirmation matcher.
- →Attackers may chain this directory traversal (CVE-2018-10822) with CVE-2018-10824 by requesting the plaintext password file at /tmp/XXX/0 via the /uir// prefix to obtain admin credentials without authentication. ↗
- →Target HTTP path prefix for all exploit variants is '/uir'; any path traversal sequence (double-slash '//' or double-dot '/..') immediately following '/uir' should be treated as a high-confidence attack indicator on D-Link DWR/DIR series routers.
- ·This vulnerability is a bypass of a previously incomplete patch; devices running firmware versions at or below the listed maximums (e.g., DWR-116 ≤1.06, DWR-921 ≤2.02) remain vulnerable even if CVE-2017-6190 was nominally 'fixed'. ↗
- ·The vulnerability is likely present on additional D-Link router models beyond those explicitly listed, as it affects a shared firmware type. ↗
- ·The exact filename of the plaintext password file under /tmp/ has been redacted by the researcher to limit trivial exploitation of EOL devices left unpatched by the vendor. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
D-Link Routers - Directory Traversal
exploitdb·2018-10-12·CVSS 7.5
CVE-2018-10822 [HIGH] D-Link Routers - Directory Traversal
D-Link Routers - Directory Traversal
---
Directory Traversal
CVE: CVE-2018-10822
CVSS v3: 8.6
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Description: Directory traversal vulnerability in the web interface on D-Link routers:
DWR-116 through 1.06,
DIR-140L through 1.02,
DIR-640L through 1.02,
DWR-512 through 2.02,
DWR-712 through 2.02,
DWR-912 through 2.02,
DWR-921 through 2.02,
DWR-111 through 1.01,
and probably others with the same type of firmware
allows remote attackers to read arbitrary files via a /.. or // after “GET /uir” in an HTTP request.
NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.
PoC:
`$ curl http://routerip/uir//etc/passwd`
The vulnerability can be used retrieve administrative password using the other disclosed vulnerability - CVE-2018-10824.
Exploit-DB
D-Link Routers - Plaintext Password
exploitdb·2018-10-12·CVSS 7.5
CVE-2018-10824 [HIGH] D-Link Routers - Plaintext Password
D-Link Routers - Plaintext Password
---
## Password stored in plaintext
CVE: CVE-2018-10824
Description:
An issue was discovered on D-Link routers:
DWR-116 through 1.06,
DIR-140L through 1.02,
DIR-640L through 1.02,
DWR-512 through 2.02,
DWR-712 through 2.02,
DWR-912 through 2.02,
DWR-921 through 2.02,
DWR-111 through 1.01,
and probably others with the same type of firmware.
NOTE: I have changed the filename in description to XXX because the vendor leaves some EOL routers unpatched and the attack is too simple
The administrative password is stored in plaintext in the /tmp/XXX/0 file. An attacker having a directory traversal (or LFI) can easily get full router access.
PoC using the directory traversal vulnerability disclosed above - CVE-2018-10822
`$ curl http://routerip/uir//tmp/XX
Nuclei
D-Link Routers - Local File Inclusion
nuclei·CVSS 7.5
CVE-2018-10822 [HIGH] D-Link Routers - Local File Inclusion
D-Link Routers - Local File Inclusion
D-Link routers DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02,DWR-512 through 2.02,DWR-712 through 2.02,DWR-912 through 2.02, DWR-921 through 2.02, DWR-111 through 1.01, and probably others with the same type of firmware allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request to the web interface.
Template:
id: CVE-2018-10822
info:
name: D-Link Routers - Local File Inclusion
author: daffainfo
severity: high
description: D-Link routers DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02,DWR-512 through 2.02,DWR-712 through 2.02,DWR-912 through 2.02, DWR-921 through 2.02, DWR-111 through 1.01, and probably others with the same type of firmware allows remote attackers to re
No writeups or analysis indexed.
2018-10-17
Published