D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test
D-Link · DNS-343 ShareCenter
The D-Link DNS-343 ShareCenter, up to and including firmware 1.05, contains a command injection flaw in its Mail Test functionality, where form parameters posted to the internal /goform/Mail_Test endpoint are passed unvalidated into a system email utility. An unauthenticated remote attacker with network access to the device can submit crafted form data to inject shell commands and execute them as root, with no user interaction or special configuration required.
D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/Mail_Test' and uses several form parameters directly in a call to a system email utility without proper input validation. An unauthenticated remote attacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The DNS-343 product line has been declared end-of-life.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.