CVE-2019-13372: D-Link Central WiFi Manager eval injection in cookie enables unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit references, and very high EPSS make this an urgent remote code execution risk.

What it is

D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 passes a cookie's username field into eval in /web/Lib/Action/IndexAction.class.php, allowing PHP code injection. An empty password bypasses authentication, so the flaw is reachable without valid credentials.

Impact

An unauthenticated remote attacker can execute arbitrary PHP code on the CWM(100) server, leading to full compromise of the management host and any managed wireless infrastructure.

Attack surface

Reached over the network via HTTP requests to the web interface, with the payload carried in a cookie; no authentication is required because an empty password bypasses the login check, and no user interaction is needed.

Exploitation

Public exploit code is referenced (Packet Storm, third-party advisories) and EPSS is 0.8249 (99.6th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Upgrade D-Link Central WiFi Manager CWM(100) to v1.03R0100_BETA6 or later per D-Link advisory SAP10117.
• If upgrade is not possible, isolate the CWM(100) management interface from untrusted networks and restrict access to trusted admin hosts.
• Enforce authentication on the web interface and reject empty-password logins at the reverse proxy or WAF layer.
• Monitor and block requests containing PHP code patterns in cookie values, especially the username field.
• Rotate any credentials or secrets stored on the CWM host in case of prior compromise.

Detection

• Inspect HTTP request logs for cookie values containing PHP code constructs such as eval, system, or base64_decode.
• Alert on successful logins with an empty password field to the CWM web interface.
• Monitor the CWM host for unexpected PHP child processes or outbound connections from the web server user.
• Review web server error logs for eval-related warnings or fatal errors in IndexAction.class.php.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.