How severe is CVE-2019-7298?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.1 out of 10.

What type of vulnerability is CVE-2019-7298?

This is classified as CWE-78, which is a common weakness in software security.

CVE-2019-7298 - HIGH Severity | CVSS 8.1

Vulnerability Description

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body, such as a body of ' /bin/telnetd' for the GetDeviceSettingsset API function. Consequently, an attacker can execute any command remotely when they control this input.

Related Vulnerabilities

CVE-2015-7611

HIGH

CVSS:8.1(High)

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

CWE-782015

CVE-2016-1482

HIGH

CVSS:8.1(High)

Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130.

CWE-782016

CVE-2017-11318

HIGH

CVSS:8.1(High)

Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed. In addition, the attacker can execute system commands remotely by abus...

CWE-782017

CVE-2017-12581

HIGH

CVSS:8.1(High)

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earl...

CWE-782017

CVE-2017-14705

HIGH

CVSS:8.1(High)

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webserv...

CWE-782017

CVE-2017-2824

HIGH

CVSS:8.1(High)

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote cod...

CWE-782017