PT-2014-1975 · D Link · Dnr-326

Ebux25 + 1 · Published 2014-07-30 · Updated 2023-04-26 · CVE-2014-7858

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DNR-326 versions prior to 2.10 build 03

Description The issue is related to the check login function and is caused by weaknesses in the authentication procedure. It allows a remote attacker to bypass authentication and log in by manipulating the username cookie parameter.

Recommendations For versions prior to 2.10 build 03, update to version 2.10 build 03 or later to resolve the issue. As a temporary workaround, consider restricting access to the check login function until a patch is available. Avoid using the username cookie parameter in the affected login endpoint until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2017-02063

CVE-2014-7858

Affected Products

Dnr-326

References · 8

• https://bdu.fstec.ru/vul/2017-02063 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-7858 · Security Note
• http://securityfocus.com/archive/1/archive/1/535626/100/200/threaded · Note
• http://search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf · Note
• http://securityfocus.com/bid/74886 · Note
• http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.html · Note
• http://securityfocus.com/archive/1/535626/100/200/threaded · Note
• http://seclists.org/fulldisclosure/2015/May/125 · Note