THREATPORT/VULNERABILITY/CVE-2017-8408
CRITICAL SEVERITY

CVE-2017-8408

Dcs 1130 Firmware vulnerability

CVSS
9.8
EPSS
5.1%
EPSS pct
92th
Exploited
No known
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call.
Affected vendor
Dlink
Affected product
Dcs 1130 Firmware
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness type (CWE)
Published
2019-07-02

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable over the network, low attack complexity, requiring no privileges, no user interaction. Successful exploitation leads to high impact to confidentiality, high impact to integrity, high impact to availability.

Its EPSS score of 5.1% reflects a lower probability of exploitation activity in the wild over the next 30 days, placing it above 92% of all scored CVEs.

Check your external exposure to CVE-2017-8408

  • Confirm whether Dlink Dcs 1130 Firmware is running on any internet-facing host or subdomain.
  • Match discovered service fingerprints against the version affected by CVE-2017-8408.
  • Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2017-8408

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2017-8408 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2017-8408?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2017-8408.

Start free scan

No credit card. Agentless.

Related vulnerabilities

CRITICAL
CVE-2019-15311
Linkplay vulnerability
CRITICAL
CVE-2020-15489
Wl Wn530hg4 Firmware vulnerability
CRITICAL
CVE-2020-15490
Wl Wn530hg4 Firmware vulnerability