D-Link Forums
Announcements => Security Advisories => Topic started by: FurryNutz on June 18, 2019, 09:43:15 AM
-
Affected Models:
DCS-930L / 931L / 932L / 933L / 934L / 5009L/ 5010L / 5020L / 5025L / 5030L
Overview:
In November 28, 2018, D-Link became a aware of a 3rd Party security researcher that accused the DCS-5020L Hardware Rev. Ax of a command injection vulnerability in the web-GUI.
After an investigation, this vulnerability is only accessible via the local-network since the cameras Web-GUI only responds on the same subnet was the PC Host web-browser. and not directly from the Internet (WAN-side))
CVE-2019-10999 :: https://nvd.nist.gov/vuln/detail/CVE-2019-10999 (https://nvd.nist.gov/vuln/detail/CVE-2019-10999)
Github :: https://github.com/fuzzywalls/CVE-2019-10999 (https://github.com/fuzzywalls/CVE-2019-10999)
Onward Security :: http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201905-138 (http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201905-138)
Details:
Note: The exploit requires credentials to be successful.
There exists an authenticated buffer overflow vulnerability in the accused cameras that can be exploited by malicious users. It occurs when a large string is passed in the WEPEncryption parameter provided to wireless.htm. The variable is expected to be a single character of some value between 0 and 4 based on radio buttons selected by the user. Because of this assumption the length of the string is never verified and passed directly to strcpy() which copies directly to a stack variable. This overwrite can be used to gain control of the return address and possible to execute arbitrary code.
Links to updated FW files per DCS model here:
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10114 (https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10114)