PT-2017-17714 · D Link · D-Link Dir-615

Published 2017-07-07 · Updated 2021-04-23 · CVE-2017-7406

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-615 versions prior to 20.12PTb04

Description The issue allows an attacker to steal user credentials by monitoring network traffic, as the device does not use SSL for authenticated pages and does not allow users to generate their own SSL certificates.

Recommendations For versions prior to 20.12PTb04, update to version 20.12PTb04 or later to resolve the issue. As a temporary workaround, consider restricting access to the device's web interface to minimize the risk of exploitation. Avoid using the device's web interface over unsecured networks until the issue is resolved.

Fix

Missing Encryption of Sensitive Data

Improper Certificate Validation

Weakness Enumeration

CWE-311

CWE-295

Related Identifiers

CVE-2017-7406

Affected Products

D-Link Dir-615

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-7406 · Security Note
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-615/REVT/DIR-615_REVT_FIRMWARE_PATCH_v20.12PTb04.zip · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7406 · Vendor Advisory
• https://qualys.com/2017/03/12/qsa-2017-03-12/qsa-2017-03-12.pdf · Note