漏洞描述
D-Link DNS-320 FW v2.06B01 Revision Ax is susceptible to a command injection vulnerability in a system_mgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters f_ntp_server, which in turn leads to arbitrary command execution.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
gist.github.comhttps://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675↗unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-25506↗supportannouncement.us.dlink.comhttps://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183↗www.dlink.comhttps://www.dlink.com/en/security-bulletin/↗