D-Link DIR 850L Router Local File Inclusion

Critical Nessus Plugin ID 103114

Synopsis

The remote router is affected by a local file inclusion vulnerability

Description

The remote D-Link DIR router is affected by a local file inclusion vulnerability that allows an attacker to execute arbitrary PHP scripts.

Solution

Upgrade to firmware 1.14B07 BETA or later

See Also

https://blogs.securiteam.com/index.php/archives/3310

Plugin Details

Severity: Critical

ID: 103114

File Name: dlink_dir_lfi.nasl

Version: $Revision: 1.3 $

Type: remote

Family: CGI abuses

Published: 2017/09/11

Modified: 2017/09/14

Dependencies: 103115

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

CVSSv3

Base Score: 10

Temporal Score: 9.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:X

Vulnerability Information

Required KB Items: installed_sw/DLink DIR

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 2017/07/27

Vulnerability Publication Date: 2017/07/11

Reference Information

OSVDB: 162445