cbcvebase.
CVE-2023-4542
published 2023-08-25

CVE-2023-4542: A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The…

PriorityP190critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
86.53%
99.7th percentile
A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238047. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

2 ranges
VendorProductVersion rangeFixed in
d-linkdar-8000-10——
dlinkdar-8000-10_firmware<= 2023-08-09—

Detection & IOCsextracted from sources · hover to see the quote

path/app/sys1.php↗
commandPOST /app/sys1.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded cmd=id↗
yara↗
regex: uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)
  • →Look for POST requests to /app/sys1.php with a 'cmd' parameter containing OS command injection payloads (e.g., cmd=id). Successful exploitation returns output matching uid=...gid=... in the response body. ↗
  • →Use FOFA queries 'body="DAR-8000-10" && title="D-Link"' or 'body="dar-8000-10" && title="d-link"' to identify exposed D-Link DAR-8000-10 devices on the internet. ↗
  • →The vulnerability is unauthenticated and remotely exploitable (CVSS 9.8, EPSS 0.923 / 99.7th percentile). No authentication headers are required in the exploit HTTP request. ↗
  • ·Affected firmware versions are only confirmed up to 20230809; devices running firmware dated after this may or may not be patched, as the vendor did not respond to disclosure. ↗
  • ·The vendor was unresponsive to disclosure; no official patch confirmation exists. Treat all DAR-8000-10 firmware ≤ 20230809 as vulnerable. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck6.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.