A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub_478D28 of the file /mng_platform.asp. The manipulation of the argument addr with the input echo 12345 > poc.txt results in command injection. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Di-7400g+_firmware | Dlink | 19.12.25a1 (including) | 19.12.25a1 (including) |