PT-2018-3889 · D Link · D-Link Dir-601

Kevin Randall · Publicado 2018-08-17 · Atualizado 2023-04-26 · CVE-2018-12710

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-601 version 2.02NA

Description An issue allows an attacker with low privilege "User" account access to intercept the response from a POST request and obtain "Admin" rights due to the admin password being displayed in XML. The vulnerability is related to the transmission of critical information in plain text, which can be exploited by a remote attacker to elevate their privileges.

Recommendations For D-Link DIR-601 version 2.02NA, as a temporary workaround, consider restricting access to the affected POST request endpoint until a patch is available. Avoid using the device with low privilege accounts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

BDU:2023-02934

CVE-2018-12710

Produtos afetados

D-Link Dir-601

Referências · 5

• 🔥 https://exploit-db.com/exploits/45306 · Exploit
• http://seclists.org/fulldisclosure/2018/Aug/45 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-12710 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-12710 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02934 · Nota de Segurança