The D-Link DNS-343 is a NAS device (costing ~520 $), with revealed vulnerability enabling remote code execution. DNS-343 has the option to share resources via a WWW server (goAhead Web Server) where the test_mail.asp script was discovered in the “maintenance” folder. Analysis of the aforementioned script showed that the data forwarded to it were not validated in any way, and that it directly executed system commands. This enabled the attacker to inject a code to a command, which was then successfully executed within the system. The manufacturer has been informed about the vulnerability. However, due to the lack of any response over the last 6 months, the bug was posted yesterday.
Source: https://cxsecurity.com/issue/WLB-2018010141
—
Do you need cybersecurity solutions for your company – contact us.
