CVE-2018-10823 in dlink dwr-116 firmware
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.
Affected software: dlink dwr-116 firmware, dlink dwr-512 firmware, dlink dwr-912 firmware, dlink dwr-111 firmware
Scores
- CVSS: 8.8 (high)
- EPSS: 77.70% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2018-10-17
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.