CVE-2018-6527

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the file htdocs/webinc/js/adv_parent_ctrl_map.php of D-Link DIR-868L (firmware DIR868LA1_FW112b04 and previous), DIR-865L (firmware patch 1.08.B01 and previous), and DIR-860L (firmware DIR860LA1_FW110b04 and previous) routers [1]. The deviceid GET parameter is reflected in the page without proper sanitization, allowing injection of arbitrary HTML and JavaScript [1]. The vulnerability is reachable from both WAN and LAN interfaces [1].

Exploitation

An attacker can craft a malicious URL containing a deviceid parameter with embedded JavaScript, such as " to execute arbitrary code in the victim's browser [1]. The attacker must lure an authenticated user (e.g., via phishing or a crafted link) to visit the vulnerable page [1]. The XSS payload executes in the context of the router's web interface, allowing the attacker to access the victim's session cookies [1].

Impact

Successful exploitation allows an attacker to steal authentication cookies from an authenticated user's session [1]. With these cookies, the attacker can impersonate the user and gain administrative access to the router's web interface, potentially leading to full device compromise, including configuration changes, information disclosure, or further network attacks [1].

Mitigation

D-Link has not released a public patch for these models (DIR-868L, DIR-865L, DIR-860L) as of the publication date [1]. Users should restrict access to the router's web interface from the WAN side and use strong, unique passwords. The affected devices may be nearing or at end-of-life; upgrading to a supported model is recommended [1].