PT-2018-18218 · D Link · Mydlink++2

Nick Leghorn · Publicado 2018-03-05 · Atualizado 2019-10-03 · CVE-2018-7698

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: D-Link mydlink+ version 3.8.5 build 259 D-Link DCS-933L version 1.05.04 D-Link DCS-934L version 1.05.04

Description: An issue was discovered where the mydlink+ app sends the username and password for connected D-Link cameras unencrypted from the app to the camera. This allows attackers to obtain these credentials and gain control of the camera, including the ability to view the camera's stream and make changes without the user's knowledge.

Recommendations: For D-Link mydlink+ version 3.8.5 build 259, consider disabling the camera connection feature until a patch is available. For D-Link DCS-933L version 1.05.04, restrict access to the camera's stream and configuration settings to minimize the risk of exploitation. For D-Link DCS-934L version 1.05.04, avoid using the mydlink+ app to connect to the camera until the issue is resolved.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-7698

Produtos afetados

Dcs-933L

Dcs-934L

Mydlink+

Referências · 3

• https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7698 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-7698 · Aviso do Fabricante