CVE-2018-6530

CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns

Description

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

SeverityCritical

CVSS9.8

Exploit probability—

Product

D-Link Multiple Routers

PublishedMar 6, 2018

First seenMar 6, 2018

Added to KEVSep 8, 2022

Weakness typeCWE-78OS command injection

How to fix

CISA required action

The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

CISA due date: Sep 29, 2022

Affected products

Product	Affected versions	Fixed in
dlink dir-860l_firmware	v ≤ 1.10b04	—
dlink dir-865l_firmware	v ≤ 1.08b01	—
dlink dir-868l_firmware	v ≤ 1.12b04	—
dlink dir-880l_firmware	v ≤ 1.08b04	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.