CVE-2018-19986

CVE-2018-19986 describes a critical command injection vulnerability in D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 routers. The vulnerability stems from insufficient input validation of the RemotePort parameter within the /HNAP1/SetRouterSettings message, allowing shell metacharacters to be injected into an iptables command. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, the high EPSS and FAUCET Risk Scores indicate significant potential for future exploitation.