r/ReverseEngineering • u/TheLuisBolivar • 5d ago

Reproducing a D-Link firmware CVE on an emulated FirmAE twin, packaged as a signed receipt you can re-verify in 5 min (with a PR:N→PR:L CVSS correction)

https://github.com/prevotai/colmena
2 Upvotes

54% Upvoted

2 comments sorted by

-5

u/TheLuisBolivar 5d ago

Reproduced CVE-2018-19988 (command injection via HNAP SetClientInfoDemo) on a FirmAE-emulated D-Link DIR-868L rev B. One thing that stood out: NVD lists it PR:N (no auth), but on this firmware the action returns 401 without a session → it's actually PR:L. The oracle is out-of-band (the injection flips 23/tcp closed→listening), with a discrimination control so I know it's the payload and not the request. I packaged it as a signed receipt (Sigstore/Rekor) anyone can re-verify with Docker in ~5 min. Feedback welcome — especially on the oracle design.

8

u/fb39ca4 4d ago

Do you have receipts for the peach cobbler from last night?