Multiple D-Link Products CVE-2013-1599 Command Injection Vulnerability

Bugtraq ID:	59564
Class:	Input Validation Error
CVE:	CVE-2013-1599
Remote:	Yes
Local:	No
Published:	Apr 30 2013 12:00AM
Updated:	Apr 30 2013 12:00AM
Credit:	Francisco Falcon and Nahuel Riva from Core Exploit Writers Team
Vulnerable:
Not Vulnerable:

Multiple D-Link Products CVE-2013-1599 Command Injection Vulnerability

Multiple D-Link products are prone to a command-injection vulnerability.

Exploiting this issue could allow an attacker to execute arbitrary commands in the context of the affected device.

Multiple D-Link Products CVE-2013-1599 Command Injection Vulnerability

An attacker can exploit these issues through a browser.

The following example URI is available:

http://www.example.com/cgi-bin/rtpd.cgi?uname&-a;cat&/etc/passwd

Multiple D-Link Products CVE-2013-1599 Command Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Multiple D-Link Products CVE-2013-1599 Command Injection Vulnerability

References:

• D-Link Homepage (D-Link)