CVE-2018-17442 is an unrestricted file upload vulnerability affecting D-Link Central WiFi Manager before version 1.03r0100-Beta1. Specifically, the onUploadLogPic endpoint allows authenticated attackers to upload arbitrary PHP code, leading to remote code execution. This vulnerability carries a high CVSS score of 8.8, indicating a critical risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, public exploit code exists (ExploitDB), and there is evidence of community discussion and media coverage, suggesting awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.00, < 1.03CPE matchmatch criteria | cpe:2.3:a:dlink:central_wifimanager:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.