PT-2019-13421 · D Link · D-Link Dir-655

Publicado 2019-07-11 · Atualizado 2021-04-23 · CVE-2019-13560

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 C versions prior to 3.02B05 BETA03

Description The issue allows remote attackers to force a blank password. This is achieved through the apply sec.cgi API endpoint, specifically by manipulating the setup wizard parameter.

Recommendations For versions prior to 3.02B05 BETA03, update to version 3.02B05 BETA03 or later to resolve the issue. As a temporary workaround, consider restricting access to the apply sec.cgi API endpoint to minimize the risk of exploitation. Avoid using the setup wizard parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2019-13560

Produtos afetados

D-Link Dir-655

Referências · 5

• 🔥 https://nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce · Exploit
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_RELEASE_NOTES_v3.02B05_BETA03.pdf · Nota
• https://osv.dev/vulnerability/CVE-2019-13560 · Aviso do Fabricante
• https://nccgroup.trust/contentassets/7188fe7f130846ffa31827fc1661d120/setupwizard.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-13560 · Nota de Segurança