Lucene search
PRIOn knowledge basePRION:CVE-2019-20215HistoryJan 29, 2020 - 3:15 a.m.
Design/Logic Flaw
2020-01-2903:15:00
PRIOn knowledge base
www.prio-n.com
3
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
Related
cve
cve
CVE-2019-20215
2020-01-29 03:15:14
packetstorm
packetstorm
D-Link ssdpcgi Unauthenticated Remote Command Execution
2020-02-07 00:00:00
checkpoint_advisories
checkpoint_advisories
D-Link DIR-859 Remote Code Execution (CVE-2019-20215)
2020-05-21 00:00:00
cvelist
cvelist
CVE-2019-20215
2020-01-29 02:23:26
nvd
nvd
CVE-2019-20215
2020-01-29 03:15:14
zdt
zdt
D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi Exploit
2020-02-10 00:00:00
metasploit
metasploit
nessus
nessus
DLink DIR-859 1.05 & 1.06B01 Multiple Vulnerabilities (RCE)
2023-12-22 00:00:00