vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-19300

N/A
Published: April 11, 2019 at 03:22 PM UTC
Updated: June 17, 2026 at 01:49 AM UTC
16 products affected across 1 vendorDwr 116 FirmwareDwr 921 FirmwareDwr 512 Firmware

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 74%

Description

On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) before firmware version 2.04b01, DWR-921 (A1) before firmware version 1.02b01, and DWR-921 (B1) before firmware version 2.03b01, there exists an EXCU_SHELL file in the web directory. By sending a GET request with specially crafted headers to the /EXCU_SHELL URI, an attacker could execute arbitrary shell commands in the root context on the affected device. Other devices might be affected as well.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Dap 1530 Firmware· D-Link
95%
v ≤ 1.05
dlink-dap-1530 (same device)
Dap 1610 Firmware· D-Link
95%
v ≤ 1.05
dlink-dap-1610 (same device)
Dwr 111 Firmware· D-Link
95%
v ≤ 1.01
dlink-dwr-111 (same device)
Dwr 116 Firmware· D-Link
95%
v ≤ 1.051.06 b11.06 b2
dlink-dwr-116 (same device)
Dwr 512 Firmware· D-Link
95%
v ≤ 2.02
dlink-dwr-512 (same device)
Dwr 711 Firmware· D-Link
95%
v ≤ 1.11
dlink-dwr-711 (same device)
Dwr 712 Firmware· D-Link
95%
v ≤ 2.02
dlink-dwr-712 (same device)
Dwr 921 Firmware· D-Link
95%
v ≤ 1.02v ≤ 2.02
dlink-dwr-921 (same device)
Dap-1530· D-Linkdevice
80%
All versions
Dap-1610· D-Linkdevice
80%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (4)

x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://community.greenbone.net/t/cve-2018-19300-remote-command-execution-vulnerability-in-d-link-dwr-and-dap-routers/1772
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://eu.dlink.com/de/de/support/support-news/2019/march/19/remote-command-execution-vulnerability-in-d-link-dwr-and-dap-routers
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.greenbone.net/en/serious-vulnerability-discovered-in-d-link-routers/
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.greenbone.net/schwerwiegende-sicherheitsluecke-in-d-link-routern-entdeckt/

CVSS

10HIGH[email protected]
Confidentiality
COMPLETE
Integrity
COMPLETE
Availability
COMPLETE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card