Vulnerabilities > CVE-2015-2049 - Unspecified vulnerability in Dlink Dcs-931L Firmware

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
dlink
exploit available
metasploit
NVD
Published: 2015-02-23
Updated: 2023-04-26

Summary

Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.

Vulnerable Configurations

Part Description Count
OS
Dlink
1
Hardware
Dlink
1

Exploit-Db

descriptionD-Link DCS-931L File Upload. CVE-2015-2049. Webapps exploit for hardware platform
fileexploits/hardware/webapps/39192.rb
idEDB-ID:39192
last seen2016-02-04
modified2016-01-07
platformhardware
port
published2016-01-07
reportermetasploit
sourcehttps://www.exploit-db.com/download/39192/
titleD-Link DCS-931L File Upload
typewebapps

Metasploit

descriptionThis module exploits a file upload vulnerability in D-Link DCS-931L network cameras. The setFileUpload functionality allows authenticated users to upload files to anywhere on the file system, allowing system files to be overwritten, resulting in execution of arbitrary commands. This module has been tested successfully on a D-Link DCS-931L with firmware versions 1.01_B7 (2013-04-19) and 1.04_B1 (2014-04-21). D-Link DCS-930L, DCS-932L, DCS-933L models are also reportedly affected, but untested.
idMSF:EXPLOIT/LINUX/HTTP/DLINK_DCS931L_UPLOAD
last seen2020-06-01
modified2019-01-10
published2016-01-05
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/dlink_dcs931l_upload.rb
titleD-Link DCS-931L File Upload

Packetstorm

References