PT-2017-16633 · D Link · D-Link Di-524 Wireless Router

Published 2017-03-06 · Updated 2023-04-26 · CVE-2017-5633

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DI-524 Wireless Router version 9.01

Description The issue affects the D-Link DI-524 Wireless Router, allowing remote attackers to perform certain actions due to multiple cross-site request forgery (CSRF) vulnerabilities. These actions include changing the admin password, rebooting the device, or possibly having other unspecified impacts. This is achieved through crafted requests to CGI programs.

Recommendations For D-Link DI-524 Wireless Router version 9.01, consider disabling access to CGI programs as a temporary workaround until a patch is available. Restrict access to the admin interface to minimize the risk of exploitation. Avoid using the device for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-5633

Affected Products

D-Link Di-524 Wireless Router

References · 5

• 🔥 http://seclists.org/fulldisclosure/2017/Feb/70 · Exploit
• 🔥 https://exploit-db.com/exploits/40983 · Exploit
• https://osv.dev/vulnerability/CVE-2017-5633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5633 · Security Note
• http://securityfocus.com/bid/96475 · Note