Overview
- Description
- On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with firmware before 1.15.01, command injection in alphapd (binary responsible for running the camera's web server) allows remote authenticated attackers to execute code through sanitized /setSystemAdmin user input in the AdminID field being passed directly to a call to system.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Risk scores
CVSS 3.0
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6.5
- Impact score
- 6.4
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-78
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5009_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49C903D2-CBE0-40D8-B9B1-F8EA4FAB9CD7",
"versionEndIncluding": "1.08.11"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5009:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2B6FCD9B-6546-4FB2-9867-FC4D7AB36A4B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5010_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB172849-0BBE-464E-8927-8BE78241C4D5",
"versionEndIncluding": "1.14.09"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5010:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CE256639-E8D7-47C7-9B8D-8267469567AF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-5020l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0EC7C9D-950F-443C-B2B5-065A7BEEECA8",
"versionEndIncluding": "1.14.09"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-5020l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B00912CC-6F2F-4F13-BED1-0DCD4DF965DB"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]