Cindycity

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same check of the file ipt SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.

**Name of the Vulnerable Software and Affected Versions** D-Link DSL-3782 version 2016-07-28 **Description** A command injection flaw exists in the Diagnostics component of the firmware. The issue occurs because the system does not properly sanitize data on the control level when processing the `Addr` parameter. A remote attacker can exploit this by manipulating the `Addr` parameter within the `/cgi-bin/New GUI/Set/Diagnostics.asp` endpoint, which affects the `system()` function. This can lead to a compromise of confidentiality, integrity, and availability of the protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/cgi-bin/New GUI/Set/Diagnostics.asp` endpoint to minimize the risk of exploitation.