CVE-2018-17786

On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi do not require authentication, which allows remote attackers to execute arbitrary code.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-10-02

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Dir-823g Firmware (D-link)

References

• https://xz.aliyun.com/t/2834