PT-2018-17102 · D Link · D-Link Dir-601

Kevin Randall · Publicado 2018-03-30 · Atualizado 2019-10-03 · CVE-2018-5708

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: D-Link DIR-601 B1 version 2.02NA

Description: An issue allows an unauthenticated user on the same local network to obtain the admin username and cleartext password from the administrator's panel. This is achieved through the configuration file restore default, which displays sensitive information in XML.

Recommendations: For D-Link DIR-601 B1 version 2.02NA, as a temporary workaround, consider restricting access to the administrator's panel and the configuration file restore default to minimize the risk of exploitation. Avoid using the device on untrusted networks until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-5708

Produtos afetados

D-Link Dir-601

Referências · 5

• 🔥 https://exploit-db.com/exploits/44388 · Exploit
• http://seclists.org/fulldisclosure/2018/Mar/66 · Nota
• https://osv.dev/vulnerability/CVE-2018-5708 · Aviso do Fabricante
• https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10111 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-5708 · Nota de Segurança