CVE-2013-7471

critical · 9.8

An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.

9.8

CVSS

24.0%

EPSS (exploit prob.)

98th

EPSS percentile

2019-06-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-77

Affected products

Vendor	Product	Affected versions
dlink	dir-300_firmware	2.14b01
dlink	dir-300	b
dlink	dir-600_firmware	< 2.17b01
dlink	dir-600	all versions
dlink	dir-645_firmware	< 1.04b11
dlink	dir-645	all versions
dlink	dir-845_firmware	< 1.02b03
dlink	dir-845	all versions
dlink	dir-865_firmware	1.05b03
dlink	dir-865	all versions

Check a specific version with /api/v1/cve/match.

References

http://www.s3cur1ty.de/m1adv2013-020
https://www.exploit-db.com/exploits/27044
http://www.s3cur1ty.de/m1adv2013-020
https://www.exploit-db.com/exploits/27044

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-7471