CVE-2020-6841 - D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter

Back Back to CVE browser

CRITICAL

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter

Published Feb 21, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 2.81%

Description

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27984
Advisory
https://gist.github.com/jezzaaa/38c752d0a129576b2cc523ce6325050f
x_refsource_MISCExploitThird Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10152
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27984		Advisory
https://gist.github.com/jezzaaa/38c752d0a129576b2cc523ce6325050f		x_refsource_MISCExploitThird Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10152		x_refsource_CONFIRMVendor Advisory