Command Injection Vulnerability on D-Link DCS-1130 Devices

CVE-2017-8408

Summary

The D-Link DCS-1130 devices are susceptible to a command injection vulnerability that arises when users set up a SMB folder for recorded video clippings. During this process, GET parameters are inadequately sanitized and are passed to a vulnerable system API, allowing attackers to execute arbitrary commands on the device. The vulnerability is located in the binary function handling the GET request, specifically designed to validate SMB credentials, leading to unauthorized system access if exploited. To mitigate risks, it’s critical for users to update their firmware and disable unnecessary SMB features.

References