CVE-2018-10823

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 77.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-17 · updated 2026-06-17
Weakness: CWE-78

Description

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.

Affected products

Dlink Dwr-111 Firmware: through 1.01
Dlink Dwr-116 Firmware: through 1.06
Dlink Dwr-512 Firmware: through 2.02
Dlink Dwr-912 Firmware: through 2.02

References

http://sploit.tech/2018/10/12/D-Link.html
https://seclists.org/fulldisclosure/2018/Oct/36
http://sploit.tech/2018/10/12/D-Link.html
https://seclists.org/fulldisclosure/2018/Oct/36

Get alerted when CVE-2018-10823 or the next vulnerability affects your stack