CVE-2018-15517
published 2019-01-31CVE-2018-15517: The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows…
PriorityP183high8.6CVSS 3.0
AVNACLPRNUINSCCNIHAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
44.10%
98.6th percentile
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | central_wifimanager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/index.php/System/MailConnect/host/{{interactsh-url}}/port/80/secure/
- →Send a GET request to the MailConnect endpoint with an arbitrary host and port; confirm SSRF by observing an outbound TCP connection (e.g., via OOB/interactsh HTTP interaction) to the attacker-controlled host on port 80.
- →Match on the interactsh_protocol value 'http' to confirm the outbound HTTP interaction triggered by the SSRF.
- →The vulnerability allows outbound TCP to any port on any IP address via the MailConnect feature; probe internal services (e.g., port 22 on 127.0.0.1) to confirm SSRF and potential firewall bypass. ↗
- ·The vulnerability is unauthenticated (PR:N, UI:N) and network-accessible (AV:N), meaning no credentials are required to trigger the SSRF.
- ·Affected version is specifically D-Link Central WiFiManager CWM-100 1.03 r0098; detections should be scoped to this CPE.
CVSS provenance
nvdv3.08.6HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vulncheck8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hq7j-8qv3-mmrm: The MailConnect feature on D-Link Central WiFiManager CWM-100 1
ghsa_unreviewed·2022-05-14
CVE-2018-15517 [HIGH] CWE-918 GHSA-hq7j-8qv3-mmrm: The MailConnect feature on D-Link Central WiFiManager CWM-100 1
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
VulnCheck
D-Link central_wifimanager Server-Side Request Forgery (SSRF)
vulncheck·2018·CVSS 8.6
CVE-2018-15517 [HIGH] D-Link central_wifimanager Server-Side Request Forgery (SSRF)
D-Link central_wifimanager Server-Side Request Forgery (SSRF)
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
Affected: D-Link central_wifimanager
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-04&host_type=src&vulnerability=cve-2018-15517; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024
No detection rules found.
Nuclei
D-Link Central WifiManager - Server-Side Request Forgery
nuclei·CVSS 8.6
CVE-2018-15517 [HIGH] D-Link Central WifiManager - Server-Side Request Forgery
D-Link Central WifiManager - Server-Side Request Forgery
D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or connections actually came from and or bypass the FW etc. This can be automated via script or using a browser.
Template:
id: CVE-2018-15517
info:
name: D-Link Central WifiManager - Server-Side Request Forgery
author: gy741
severity: high
description: D-Link Central WifiManager is susceptible to server-side request forgery. The Ma
Unit42
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
blogs_unit42·2021-10-14
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
## Executive Summary
Recently, Unit 42 has observed active exploits related to an open-source service called Interactsh. This tool can generate specific domain names to help its users test whether an exploit is successful. It can be used by researchers – but also by attackers – to validate vulnerabilities via real-time monitoring on the trace path for the domain. Researchers creating a proof of concept (PoC) for an exploit can insert Interactsh to check whether the PoC is working, but the service could also be used by attackers who want to be sure an exploit is working.
This blog will first introduce the Interactsh tool and how researchers or attackers can leverage it to perform vulnerability validation. We then describe some of the many exploits in the wild leveraging this tool, and we
Unit42
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
blogs_unit42·2021-10-14
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
Threat Research Center
Threat Research
Cybercrime
## Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
Yue Guan
Jin Chen
Leo Olson
Wayne Xin
Daiping Liu
Published: October 14, 2021
Cybercrime
Threat Research
Attack analysis
Exploit
Exploit in the wild
Interactsh
## Executive Summary
Recently, Unit 42 has observed active exploits related to an open-source service called Interactsh . This tool can generate specific domain names to help its users test whether an exploit is successful. It can be used by researchers – but also by attackers – to validate vulnerabilities via real-time monitoring on the trace path for the domain. Researchers creating a proof of concept (PoC) for an exploit can insert Interactsh to check whether the PoC
http://packetstormsecurity.com/files/150243/D-LINK-Central-WifiManager-CWM-100-1.03-r0098-Server-Side-Request-Forgery.htmlhttp://seclists.org/fulldisclosure/2018/Nov/28http://packetstormsecurity.com/files/150243/D-LINK-Central-WifiManager-CWM-100-1.03-r0098-Server-Side-Request-Forgery.htmlhttp://seclists.org/fulldisclosure/2018/Nov/28
2019-01-31
Published
Exploited in the wild