D-Link DCS-933L Command Injection Vulnerability in alphapd Component

A command injection vulnerability has been identified in the D-Link DCS-933L camera, affecting firmware versions prior to 1.14.11. The issue arises in the alphapd component, specifically within the setSystemAdmin function. The vulnerability allows remote attackers to execute arbitrary commands on the operating system by manipulating the AdminID parameter, which is improperly sanitized before being executed. This vulnerability is present in products that are no longer supported by the manufacturer.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device's operating system. In the proof-of-concept demonstration, the telnetd service was started, allowing remote access to the device.

Reproduction

To reproduce this vulnerability, send a POST request to the /setSystemAdmin endpoint with a crafted AdminID parameter. The request must include a valid Digest authorization. Once the command injection is successful, the executed command's effect can be observed, such as starting a telnet server that can be accessed remotely.