PT-2017-11428 · D Link · Dir-600M

Published 2017-07-20 · Updated 2023-04-26 · CVE-2017-10676

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-600M versions prior to C1 v3.05ENB01 beta 20170306

Description A security issue was discovered in the form2userconfig.cgi endpoint, specifically in the username parameter, which is vulnerable to cross-site scripting (XSS). This allows for potential malicious script injection.

Recommendations For versions prior to C1 v3.05ENB01 beta 20170306, consider updating to a version that includes the fix for this issue. As a temporary workaround, restrict access to the form2userconfig.cgi endpoint to minimize the risk of exploitation. Avoid using the username parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-10676

Affected Products

Dir-600M

References · 4

• 🔥 https://iscouncil.blogspot.com/2017/07/stored-xss-in-d-link-dir-600m-router.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-10676 · Security Note
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-600M/REVC/DIR-600M_REVC_FIRMWARE_PATCH_NOTES_3.05B01_EN.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10676 · Vendor Advisory