CRITICAL

CVE-2018-19300

CVSS v3

9.8

CRITICAL

EPSS Score

23.3%

exploit probability

CISA KEV

No

known exploited

Exploitation

SSVC status

Description

On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) before firmware version 2.04b01, DWR-921 (A1) before firmware version 1.02b01, and DWR-921 (B1) before firmware version 2.03b01, there exists an EXCU_SHELL file in the web directory. By sending a GET request with specially crafted headers to the /EXCU_SHELL URI, an attacker could execute arbitrary shell commands in the root context on the affected device. Other devices might be affected as well.

Technical details

Published
4/11/2019

Frequently asked questions

What is CVE-2018-19300?

On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) before firmware version 2.04b01, DWR-921 (A1) before firmware version 1.02b01, and DWR-921 (B1) before firmware version 2.03b01, there exists an EXCU_SHELL file in the web directory. By sending a GET request with specially crafted headers to the /EXCU_SHELL URI, an attacker could execute arbitrary shell commands in the root context on the affected device. Other devices might be affected as well.

Is CVE-2018-19300 actively exploited?

Active exploitation of CVE-2018-19300 has not been confirmed. The EPSS score is 23.3%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2018-19300?

CVE-2018-19300 has a CVSS v3 base score of 9.8 (CRITICAL severity).

Is CVE-2018-19300 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.