CVE-2019-17510

published 2019-10-11

CVE-2019-17510: D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-846_firmware	—	—
dlink	dir-846_firmware	—	—
dlink	dir-846_firmware	—	—

CWE-78