published April 11, 2019
NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.
🚨 A crafty GET request is all it takes to get a shell on these D-Link devices! 🌐 Think of the EXCU_SHELL file as a secret passage in a hotel that staff forgot to lock. An unwelcome visitor can stroll right in with just a special key (or in this case, a crafted request) to access the main control room – access to everything! Once an attacker slips through this passage, they could run any command they want on the device, potentially compromising the entire network. This could lead to unauthorized access, data theft, or even turning the device into a base for further attacks. Absolutely devastating for your security!
Think of the EXCU_SHELL file as a secret passage in a hotel that staff forgot to lock. An unwelcome visitor can stroll right in with just a special key (or in this case, a crafted request) to access the main control room – access to everything! This vulnerability allows an attacker to execute arbitrary shell commands on affected D-Link devices by sending a specially crafted GET request to the /EXCU_SHELL URI. This means they can control the device from the root context without any authentication.
Once an attacker slips through this passage, they could run any command they want on the device, potentially compromising the entire network. This could lead to unauthorized access, data theft, or even turning the device into a base for further attacks. Absolutely devastating for your security! To protect your network, update the firmware on your D-Link devices to the latest versions: 1.06b01 for DAP-1530 and DAP-1610; 1.02v02 for DWR-111; 1.06b03 for DWR-116; 2.02b01 for DWR-512; 1.11 for DWR-711; 2.04b01 for DWR-712; 1.02b01 for DWR-921 (A1) and 2.03b01 for DWR-921 (B1). Once updated, you’ll close that secret passage! You’ve got this! Update those firmware versions now, and you’ll be one step closer to securing your devices! 🛡️