deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13135
Published: 2019-07-01
Description: ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/cdb383749ef7b68a38891440af8cc23e0115306d; https://github.com/ImageMagick/ImageMagick/issues/1599
CVE: CVE-2019-13136
Published: 2019-07-01
Description: ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/fe5f4b85e6b1b54d3b4588a77133c06ade46d891; https://github.com/ImageMagick/ImageMagick/issues/1602
CVE: CVE-2019-13137
Published: 2019-07-01
Description: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/35ccb468ee2dcbe8ce9cf1e2f1957acc27f54c34; https://github.com/ImageMagick/ImageMagick/issues/1601
CVE: CVE-2019-3962
Published: 2019-07-01
Description: Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the authenticated adversary to inject arbitrary text into the feed status, which will remain saved post session expiration.
CVSS Score: 3.3 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109025; https://www.tenable.com/security/tns-2019-04; http://www.securityfocus.com/bid/109025
CVE: CVE-2019-7275
Published: 2019-07-01
Description: Optergy Proton/Enterprise devices allow Open Redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/155268/Optergy-Proton-Enterprise-BMS-2.3.0a-Open-Redirect.html; http://www.securityfocus.com/bid/108686; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7276
Published: 2019-07-01
Description: Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/171564/Optergy-Proton-And-Enterprise-BMS-2.0.3a-Command-Injection.html; http://www.securityfocus.com/bid/108686; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7277
Published: 2019-07-01
Description: Optergy Proton/Enterprise devices allow Unauthenticated Internal Network Information Disclosure.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/108686; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-008
CVE: CVE-2019-7278
Published: 2019-07-01
Description: Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/108686; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-008
CVE: CVE-2019-10979
Published: 2019-07-01
Description: SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/108924; https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories; https://www.us-cert.gov/ics/advisories/icsa-19-178-04
CVE: CVE-2019-5497
Published: 2019-07-01
Description: NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that could allow unauthorized arbitrary command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-6642
Published: 2019-07-01
Description: In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.
CVSS Score: 8.8 (HIGH)
References: https://support.f5.com/csp/article/K40378764; https://support.f5.com/csp/article/K40378764?utm_source=f5support&amp%3Butm_medium=RSS; https://support.f5.com/csp/article/K40378764
CVE: CVE-2019-7271
Published: 2019-07-01
Description: Nortek Linear eMerge 50P/5000P devices have Default Credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-006; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7272
Published: 2019-07-01
Description: Optergy Proton/Enterprise devices allow Username Disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: http://packetstormsecurity.com/files/155259/Optergy-BMS-2.0.3a-Account-Reset-Username-Disclosure.html; http://www.securityfocus.com/bid/108686; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7273
Published: 2019-07-01
Description: Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/155265/Optergy-Proton-Enterprise-BMS-2.0.3a-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/bid/108686; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7274
Published: 2019-07-01
Description: Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155269/Optergy-2.3.0a-Remote-Root.html; http://www.securityfocus.com/bid/108686; https://applied-risk.com/labs/advisories
CVE: CVE-2019-9702
Published: 2019-07-01
Description: Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/108795; https://support.symantec.com/us/en/article.SYMSA1485.html; http://www.securityfocus.com/bid/108795
CVE: CVE-2019-9703
Published: 2019-07-01
Description: Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/108796; https://support.symantec.com/us/en/article.SYMSA1485.html; http://www.securityfocus.com/bid/108796
CVE: CVE-2019-13147
Published: 2019-07-02
Description: In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/mpruett/audiofile/issues/54; https://lists.debian.org/debian-lts-announce/2023/11/msg00006.html; https://github.com/mpruett/audiofile/issues/54
CVE: CVE-2019-13148
Published: 2019-07-02
Description: An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the UDP Ports To Open in Add Gaming Rule.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject678.jpg; https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject678.jpg
CVE: CVE-2019-13149
Published: 2019-07-02
Description: An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the key passwd in Routing RIP Settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject2.jpg; https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject2.jpg
CVE: CVE-2019-13150
Published: 2019-07-02
Description: An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication). The command injection exists in the key ip_addr.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject1.jpg; https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject1.jpg
CVE: CVE-2019-13151
Published: 2019-07-02
Description: An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the action set_sta_enrollee_pin_5g and the key wps_sta_enrollee_pin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject3.jpg; https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject3.jpg
CVE: CVE-2019-13152
Published: 2019-07-02
Description: An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP Address in Add Gaming Rule.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject678.jpg; https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject678.jpg
CVE: CVE-2019-13153
Published: 2019-07-02
Description: An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the Private Port in Add Virtual Server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject45.jpg; https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject45.jpg
CVE: CVE-2019-13154
Published: 2019-07-02
Description: An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the TCP Ports To Open in Add Gaming Rule.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject678.jpg; https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject678.jpg
CVE: CVE-2019-13155
Published: 2019-07-02
Description: An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP Address in Add Virtual Server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject45.jpg; https://github.com/TeamSeri0us/pocs/blob/master/iot/trendnet/cmdinject45.jpg
CVE: CVE-2019-4087
Published: 2019-07-02
Description: IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by servers and storage agents in response to specifically crafted communication exchanges. By sending an overly long request, a remote attacker could overflow a buffer and execute arbitrary code on the system with instance id privileges or cause the server or storage agent to crash. IBM X-Force ID: 157510.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.ibm.com/support/docview.wss?uid=ibm10882472; https://exchange.xforce.ibmcloud.com/vulnerabilities/157510; http://www.ibm.com/support/docview.wss?uid=ibm10882472
CVE: CVE-2019-4088
Published: 2019-07-02
Description: IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents could allow a local attacker to gain elevated privileges on the system, caused by loading a specially crafted library loaded by the dsmqsan module. By setting up such a library, a local attacker could exploit this vulnerability to gain root privileges on the vulnerable system. IBM X-Force ID: 157511.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=ibm10882472; https://exchange.xforce.ibmcloud.com/vulnerabilities/157511; http://www.ibm.com/support/docview.wss?uid=ibm10882472
CVE: CVE-2019-4129
Published: 2019-07-02
Description: IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain sensitive information, caused by an error message containing a stack trace. By creating an error with a stack trace, an attacker could exploit this vulnerability to potentially obtain details on the Operations Center architecture. IBM X-Force ID: 158279.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: http://www.ibm.com/support/docview.wss?uid=ibm10883236; https://exchange.xforce.ibmcloud.com/vulnerabilities/158279; http://www.ibm.com/support/docview.wss?uid=ibm10883236
CVE: CVE-2019-4134
Published: 2019-07-02
Description: IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158281.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158281; https://www.ibm.com/support/docview.wss?uid=ibm10886607; https://exchange.xforce.ibmcloud.com/vulnerabilities/158281
CVE: CVE-2019-4140
Published: 2019-07-02
Description: IBM Tivoli Storage Manager Server (IBM Spectrum Protect 7.1 and 8.1) could allow a local user to replace existing databases by restoring old data. IBM X-Force ID: 158336.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10883346; https://exchange.xforce.ibmcloud.com/vulnerabilities/158336; http://www.ibm.com/support/docview.wss?uid=ibm10883346
CVE: CVE-2019-4260
Published: 2019-07-02
Description: IBM Daeja ViewONE Professional, Standard & Virtual 5.0 through 5.0.5 could allow an unauthorized user to download server files resulting in sensitive information disclosure. IBM X-Force ID: 160012.
CVSS Score: 5.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10884382; https://exchange.xforce.ibmcloud.com/vulnerabilities/160012; http://www.ibm.com/support/docview.wss?uid=ibm10884382
CVE: CVE-2019-4292
Published: 2019-07-02
Description: IBM Security Guardium 10.5 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable web server. IBM X-Force ID: 160698.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://www.securityfocus.com/bid/109005; https://exchange.xforce.ibmcloud.com/vulnerabilities/160698; https://www.ibm.com/support/docview.wss?uid=ibm10888279
CVE: CVE-2017-8408
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE: CVE-2019-13056
Published: 2019-07-02
Description: An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of CSRF protection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/153492/CyberPanel-1.8.4-Cross-Site-Request-Forgery.html; https://cyberpanel.net/category/news/; http://packetstormsecurity.com/files/153492/CyberPanel-1.8.4-Cross-Site-Request-Forgery.html
CVE: CVE-2019-12594
Published: 2019-07-02
Description: DOSBox 0.74-2 has Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00053.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931222
CVE: CVE-2019-7263
Published: 2019-07-02
Description: Linear eMerge E3-Series devices have a Version Control Failure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-18
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7264
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7265
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/155267/Nortek-Linear-eMerge-E3-Access-Controller-1.00-06-SSH-FTP-Remote-Root.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005
CVE: CVE-2019-7266
Published: 2019-07-02
Description: Linear eMerge 50P/5000P devices allow Authentication Bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-565
References: http://packetstormsecurity.com/files/155250/Linear-eMerge50P-5000P-4.6.07-Remote-Code-Execution.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-006
CVE: CVE-2019-7267
Published: 2019-07-02
Description: Linear eMerge 50P/5000P devices allow Cookie Path Traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/155250/Linear-eMerge50P-5000P-4.6.07-Remote-Code-Execution.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-006
CVE: CVE-2019-7268
Published: 2019-07-02
Description: Linear eMerge 50P/5000P devices allow Unauthenticated File Upload.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155250/Linear-eMerge50P-5000P-4.6.07-Remote-Code-Execution.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-006
CVE: CVE-2019-7269
Published: 2019-07-02
Description: Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/155250/Linear-eMerge50P-5000P-4.6.07-Remote-Code-Execution.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-006
CVE: CVE-2019-7270
Published: 2019-07-02
Description: Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-006; https://www.us-cert.gov/ics/advisories/icsa-20-184-01
CVE: CVE-2019-7259
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/155260/Linear-eMerge-E3-1.00-06-Privilege-Escalation.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005
CVE: CVE-2019-7260
Published: 2019-07-02
Description: Linear eMerge E3-Series devices have Cleartext Credentials in a Database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7261
Published: 2019-07-02
Description: Linear eMerge E3-Series devices have Hard-coded Credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/155267/Nortek-Linear-eMerge-E3-Access-Controller-1.00-06-SSH-FTP-Remote-Root.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005
CVE: CVE-2019-7262
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/155263/Nortek-Linear-eMerge-E3-Access-Control-Cross-Site-Request-Forgery.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005
CVE: CVE-2017-8404
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x0008F598 which calls the "mailLoginTest" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8407
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user's password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8