CVE-2018-10746

An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'get' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'get <node_name attr>' function and cause memory corruption. Furthermore, it is possible to redirect the flow of the program and execute arbitrary code.
References
Link Resource
https://github.com/kgsdy/D-Link-DSL-3782-EU/blob/master/get.md Exploit Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:d-link:dsl-3782_firmware:1.01:*:*:*:*:*:*:*
cpe:2.3:h:d-link:dsl-3782:-:*:*:*:*:*:*:*

Information

Published : 2018-05-04 11:29

Updated : 2018-06-12 10:32


NVD link : CVE-2018-10746

Mitre link : CVE-2018-10746


JSON object : View

CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Advertisement

dedicated server usa

Products Affected

d-link

  • dsl-3782
  • dsl-3782_firmware