PT-2014-1975 · D Link · Dnr-326

Ebux25 + 1 · Publicado 2014-07-30 · Atualizado 2023-04-26 · CVE-2014-7858

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DNR-326 versions prior to 2.10 build 03

Description The issue is related to the check login function and is caused by weaknesses in the authentication procedure. It allows a remote attacker to bypass authentication and log in by manipulating the username cookie parameter.

Recommendations For versions prior to 2.10 build 03, update to version 2.10 build 03 or later to resolve the issue. As a temporary workaround, consider restricting access to the check login function until a patch is available. Avoid using the username cookie parameter in the affected login endpoint until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2017-02063

CVE-2014-7858

Produtos afetados

Dnr-326

Referências · 8

• http://securityfocus.com/archive/1/archive/1/535626/100/200/threaded · Nota
• http://search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf · Nota
• http://securityfocus.com/bid/74886 · Nota
• http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.html · Nota
• http://securityfocus.com/archive/1/535626/100/200/threaded · Nota
• https://bdu.fstec.ru/vul/2017-02063 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-7858 · Nota de Segurança
• http://seclists.org/fulldisclosure/2015/May/125 · Nota