CVE-2019-13372

What it actually does

Remote unauthenticated eval injection in a PHP cookie handler allows arbitrary code execution by supplying a malicious username value that is passed directly to eval while an empty password field bypasses authentication checks.

Why it matters to the business

Attackers can gain complete control of the wireless management platform, reconfigure access points, intercept traffic, or pivot into the broader network; the vulnerability has been weaponized and carries high exploit probability years after disclosure.

How an attack unfolds

An attacker sends an HTTP request containing a specially crafted cookie whose username field holds PHP code; because authentication is bypassed with an empty password field, the code is evaluated server-side, granting shell access or the ability to upload further payloads.

How to fix it

Upgrade every affected D-Link Central WiFi Manager CWM(100) installation to version 1.03R0100_BETA6 or newer; if an upgrade path is unavailable, isolate the management interface behind a firewall or VPN and disable external access.

How to confirm the fix worked

Confirm the installed version string matches or exceeds 1.03R0100_BETA6; review web server access logs for requests containing eval-like patterns in cookies targeting IndexAction.class.php; retest authentication flow with empty password values.

Typical attack path

1. Identify an exposed D-Link Central WiFi Manager instance
2. Craft an HTTP request with a cookie containing PHP code in the username field and an empty password
3. Submit the request to the IndexAction handler
4. Execute arbitrary PHP, establish persistence, and move laterally

How to detect it

Search web server logs for requests to IndexAction.class.php that contain cookie fields with PHP syntax or eval constructs; look for authentication events with empty password values followed by unexpected file writes or process spawns.

• IndexAction.class.php
• username=.*eval(
• password=

What your security team should do

• Immediately restrict network access to the management interface
• Apply the vendor patch or migrate to a supported platform
• Monitor for anomalous cookie values and PHP execution in web logs
• Add the device to the vulnerability scanning inventory for ongoing verification