Back to KEVs

CVE-2023-4542

D-Link DAR-8000-10 sys1.php os command injection

Basic Information

CVE State
PUBLISHED
Reserved Date
August 25, 2023
Published Date
August 25, 2023
Last Updated
August 02, 2024
Vendor
D-Link
Product
DAR-8000-10
Description
A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238047. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Es wurde eine Schwachstelle in D-Link DAR-8000-10 bis 20230809 ausgemacht. Sie wurde als kritisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei /app/sys1.php. Durch das Manipulieren des Arguments cmd mit der Eingabe id mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
Tags
nuclei_scanner

CVSS Scores

CVSS v3.1

6.3 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v3.0

6.3 - MEDIUM

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0

6.5

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploit Status

Proof of Concept Available
Yes (added 2023-08-09 05:57:13 UTC) Source

References

https://vuldb.com/?id.238047 https://vuldb.com/?ctiid.238047 https://github.com/PumpkinBridge/cve/blob/main/rce.md

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2026-03-19 00:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4542.yaml 2025-04-25 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

PumpkinBridge/CVE-2023-4542

Type: github • Created: 2023-08-09 05:57:13 UTC • Stars: 2

Timeline

  • Proof of Concept Exploit Available

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel