PT-2017-17713 · D Link · D-Link Dir-615
Publicado
2017-07-07
·
Atualizado
2021-04-23
·
CVE-2017-7405
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
D-Link DIR-615 versions prior to 20.12PTb04
Description
The issue allows an attacker to take over an administrative session without authentication credentials by spoofing the IP address of the victim's host. An attacker can obtain the victim's and router's IP addresses by sniffing network traffic. If the victim accesses the web interface from a different network behind a NAT/Proxy, an attacker can also sniff the traffic to determine the public IP address of the victim's router and take over the session without being prompted for credentials.
Recommendations
For D-Link DIR-615 versions prior to 20.12PTb04, update to version 20.12PTb04 or later to resolve the issue. As a temporary workaround, consider restricting web access to the router's interface or limiting access to trusted networks to minimize the risk of exploitation. Avoid using the web interface from untrusted or public networks until the issue is resolved.
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
D-Link Dir-615