D-Link DIR 850L Router Local File Inclusion

Critical Nessus Plugin ID 103114

Synopsis

The remote router is affected by a local file inclusion vulnerability

Description

The remote D-Link DIR router is affected by a local file inclusion vulnerability that allows an attacker to execute arbitrary PHP scripts.

Solution

Upgrade to firmware 1.14B07 BETA or later

See Also

https://blogs.securiteam.com/index.php/archives/3310

Plugin Details

Severity: Critical

ID: 103114

File Name: dlink_dir_lfi.nasl

Version: 1.5

Type: remote

Family: CGI abuses

Published: 2017/09/11

Updated: 2018/06/14

Dependencies: 103115

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

CVSS v3.0

Base Score: 10

Temporal Score: 9.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:X

Vulnerability Information

Required KB Items: installed_sw/DLink DIR

Exploited by Nessus: true

Patch Publication Date: 2017/07/27

Vulnerability Publication Date: 2017/07/11