Critical severity9.8NVD Advisory· Published May 13, 2019· Updated Jun 17, 2026
CVE-2018-19987
CVE-2018-19987
Description
D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code, the IsAccessPoint parameter is saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. A vulnerable /HNAP1/SetAccessPointMode XML message could have shell metacharacters in the IsAccessPoint element such as the telnetd string.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
13- cpe:2.3:o:d-link:dir-818lw_firmware:2.05.b03:*:*:*:*:*:*:*
cpe:2.3:o:d-link:dir-822_firmware:202krb06:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:d-link:dir-822_firmware:202krb06:*:*:*:*:*:*:*
- cpe:2.3:o:dlink:dir-822_firmware:3.10b06:*:*:*:*:*:*:*
- cpe:2.3:o:d-link:dir-860l_firmware:2.03.b03:*:*:*:*:*:*:*
- cpe:2.3:o:d-link:dir-868l_firmware:2.05b02:*:*:*:*:*:*:*
- cpe:2.3:o:d-link:dir-880l_firmware:1.20b01_01_i3se:beta:*:*:*:*:*:*
- cpe:2.3:o:d-link:dir-890l\/r_firmware:1.21b02:beta:*:*:*:*:*:*
- D-Link/DIR-822 Rev.Bdescription
Patches
Vulnerability mechanics
References
1- github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.