CVE-2019-14337

Description

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command line interface, as demonstrated by the `/bin/sh -c wget` sequence.

Weakness classification

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references

• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory