CVE-2018-17440

published 2018-10-08

CVE-2018-17440: An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has…

Priority P2 79 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking advantage of this, a remote unauthenticated attacker could execute arbitrary PHP code by uploading any file in the web root directory and then accessing it via a request.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	central_wifimanager	>= 1.00 < 1.03	1.03

Detection & IOCs extracted from sources · hover to see the quote

port 9000↗

other admin:admin (FTP hardcoded credentials)↗

path /web/public↗

filename write_file.php↗

url https://127.0.0.1/public/write_file.php↗

path /web/captivalportal↗

url https://127.0.0.1/index.php/ReportSecurity/ExportAP/type/TXT↗

url https://127.0.0.1/index.php/Config/onUploadLogPic↗

url https://127.0.0.1/captivalportal/↗

path /index.php/Config/UpdateSite↗

path /index.php/System/addUser↗

• → Detect FTP connections to port 9000 targeting the D-Link Central WiFiManager FTP server with hardcoded admin/admin credentials — any FTP login on this non-standard port is suspicious. ↗
• → Alert on FTP STOR commands uploading .php files into the /web/public directory on port 9000, which directly enables unauthenticated RCE. ↗
• → Monitor HTTP GET requests to /public/*.php immediately following FTP activity on port 9000 — this two-step pattern (FTP upload then HTTP fetch) is the core exploit chain. ↗
• → Detect POST requests to /index.php/Config/onUploadLogPic with .tar/.rar file uploads from unauthenticated or low-privilege sessions, which is the authenticated RCE vector. ↗
• → Monitor sequential HTTP GET requests to /captivalportal/<epoch>/<filename>.php with incrementing epoch values in the path — this is the timing-based path enumeration used to reach the uploaded PHP webshell. ↗
• → Detect GET requests to /index.php/ReportSecurity/ExportAP/type/TXT from unauthenticated or suspicious sessions — this endpoint is queried by the exploit to obtain server time for epoch calculation. ↗

• · The FTP server runs on port 9000 by default and the credentials are hardcoded with no UI option to change them, meaning the attack surface cannot be mitigated through configuration alone on vulnerable versions. ↗
• · The application does not restrict unauthenticated users from requesting any file in the web root, so any file uploaded via FTP is immediately accessible over HTTP without authentication. ↗
• · The captive portal upload path is named after the PHP time() epoch, making it predictable and enumerable by an attacker who first queries the server time endpoint. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434