CVE-2019-13373: D-Link Central WiFi Manager unauthenticated SQL injection in Conn.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and high EPSS (0.68) make this an urgent exposure despite the absence of KEV listing.

What it is

D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 fails to validate input passed to the dbSQL parameter of /web/Public/Conn.php, allowing arbitrary SQL statements to run against the backend database. Because the endpoint is public and requires no authentication, the flaw exposes the management platform's database to direct compromise.

Impact

An unauthenticated attacker can read, modify, or delete arbitrary data in the CWM database, potentially including administrator credentials and managed access point configuration, leading to full control of the wireless management platform.

Attack surface

Reachable over the network via HTTP requests to /web/Public/Conn.php with a crafted dbSQL parameter; the CVSS vector (AV:N/PR:N/UI:N) and the public path indicate no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is 0.68019 (99.3rd percentile), indicating a high modeled likelihood of exploitation; reference tags include only Patch and Vendor Advisory, with no public exploit tag.

What to do

• Upgrade Central WiFi Manager to v1.03R0100_BETA6 or later per D-Link advisory SAP10117.
• If patching cannot be done immediately, restrict access to the CWM web interface to trusted management networks and block external reachability of /web/Public/.
• Place the CWM management interface behind a VPN or authenticated reverse proxy so the public Conn.php endpoint is not internet-exposed.
• Review database and CWM logs for unexpected SQL activity and rotate any credentials stored or managed by the platform.
• Monitor D-Link advisories for further updates, as the affected product line is legacy.

Detection

• Inspect web server and proxy logs for requests to /web/Public/Conn.php with unusual or SQL-like dbSQL parameter values.
• Alert on SQL error strings or unexpected database errors returned by the CWM web interface.
• Baseline normal dbSQL parameter values and flag deviations, especially UNION, stacked queries, or comment syntax.
• Monitor database audit logs for queries originating from the CWM application host that fall outside normal application behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.