CVE-2019-13373

EPSS 68.0%

Vexday Risk Score

30Baixo

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 68.0%KEV nãoPoC —Nuclei —Metasploit simPatch —

Ciclo de vida

06 jul 2019Exploit Metasploit disponível

06 jul 2019Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL.

Produtos afetados

n/a · n/a

Referências

https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117 https://unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/