CVE-2019-13373

What it actually does

Unvalidated input in /web/Public/Conn.php permits arbitrary SQL statements to execute in the backend database via the dbSQL parameter, enabling full read/write access without authentication.

Why it matters to the business

Compromise of the WiFi management database can expose network credentials and device configurations, allowing attackers to disrupt wireless services or pivot deeper into the organization.

How an attack unfolds

An unauthenticated attacker sends a crafted request to the Conn.php endpoint embedding malicious SQL in the dbSQL parameter; the lack of input sanitization causes the database to execute the attacker-supplied statements, returning data or performing administrative actions.

How to fix it

Upgrade D-Link Central WiFi Manager CWM(100) to version 1.03R0100_BETA6 or later; restrict direct internet exposure of the management portal until patched.

How to confirm the fix worked

Confirm installed version is 1.03R0100_BETA6 or newer; attempt benign SQL test payloads against the endpoint and verify that error messages or unexpected results no longer appear.

Typical attack path

1. Locate an exposed D-Link Central WiFi Manager instance
2. Issue HTTP request to /web/Public/Conn.php supplying SQL injection payload in dbSQL
3. Execute queries to extract credentials, enumerate tables, or modify records
4. Leverage obtained data to authenticate to other management interfaces or connected devices

How to detect it

Inspect web server access logs for requests to /web/Public/Conn.php that contain SQL keywords such as UNION, SELECT, or DROP inside the dbSQL parameter value.

• /web/Public/Conn.php
• dbSQL=
• dbSQL=.*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP)

What your security team should do

• Apply the vendor upgrade to 1.03R0100_BETA6 immediately
• Place the management interface behind a VPN or IP allow-list
• Add web application firewall rules to block common SQL injection patterns targeting dbSQL
• Review historical access logs for the Conn.php endpoint