D-Link DNS-340L addon_center.cgi OS Command Injection (CWE-78) Analysis

D-Link DNS-340L OS Command Injection Vulnerability Summary Vulnerability Overview Vulnerability Name: D-Link DNS-340L OS Command Injection Internal Tracking ID: DLINK-CMD-007 Vulnerability Type: OS Command Injection (CWE-78) CVSS 3.1 Score: 8.8 (High) Verification Status: Confirmed Affected Versions: DNS-340L REVA 1.01B04 firmware build Affected Binary: Architecture: ARM EABI soft float Impact Scope Vendor: D-Link Product: DNS-340L, ShareCenter Confirmed Affected Firmware: DNS-340L REVA 1.01B04 Web Endpoint: Attack Path: An authenticated user sends a POST request to via in the Add-On Center. The parameters , , , and are concatenated directly into shell commands without escaping, allowing an authenticated web attacker to inject shell metacharacters to execute arbitrary commands. Impact: Authenticated remote command execution; attackers can run arbitrary shell commands, modify device configurations, install/remove files, or disrupt NAS services. Remediation 1. Refactor shell command construction to use APIs like with parameter arrays, avoiding direct string concatenation. 2. Restrict to HTTPS URLs and treat , , , and as structured values rather than shell fragments. 3. Perform strict server-side validation for add-on identifiers, URLs, schemas, numeric flags, and account names. 4. Sanitize parameters for shell metacharacters, command substitution, quotes, delimiters, and malformed URLs before passing them to package management actions. 5. Add server-side authorization checks and CSRF protection for add-on install and remove operations. POC / Exploit Code Low-Impact Marker Examples (PoC Requests) Representative Command Concatenation Evidence for DNS-340L Affected Firmware Binary SHA1 and Marker Hits Vulnerability Trigger Command Template (from Source Code) Parameters and are inserted outside the shell quotes; a single quote can escape the parameter, enabling the injection of shell metacharacters to execute arbitrary commands.

Goal Reached Thanks to every supporter — we hit 100%!

D-Link DNS-340L addon_center.cgi OS Command Injection (CWE-78) Analysis

More from this source