CVE-2018-20057
published 2018-12-11CVE-2018-20057: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to…
PriorityP277high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
7.40%
93.7th percentile
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d-link | dir-605l_firmware | — | — |
| d-link | dir-619l_firmware | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hwc8-9gf8-7f28: An issue was discovered in /bin/boa on D-Link DIR-619L Rev
ghsa_unreviewed·2022-05-14
CVE-2018-20057 [HIGH] CWE-78 GHSA-hwc8-9gf8-7f28: An issue was discovered in /bin/boa on D-Link DIR-619L Rev
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter.
VulnCheck
D-Link dir-619l_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2018·CVSS 8.8
CVE-2018-20057 [HIGH] D-Link dir-619l_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
D-Link dir-619l_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter.
Affected: D-Link dir-619l_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/; https://cujo.com/blog/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/; https://cujo.com/the-2022-2023-iot-botnet-report-vul
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-12-11
Published
Exploited in the wild