Remote Code Execution Vulnerability in D-Link DIR-859 Router

CVE-2019-20215

Summary

The D-Link DIR-859 routers in firmware versions 1.05 and 1.06B01 Beta01 are vulnerable to remote code execution due to inadequate handling of HTTP_ST in the ssdpcgi() function. By exploiting a flaw in the handling of the 'urn:' directive in the M-SEARCH method, an attacker could potentially execute arbitrary OS commands on the affected device. This vulnerability arises when inputs are not properly validated, allowing malicious users to insert shell metacharacters and manipulate the execution of commands, thus compromising the integrity of the network device and potentially facilitating further attacks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2019-20215
Created by Rapid7

Metasploit exploit module for CVE-2019-20215
Created by Rapid7

References