PT-2017-6114 · D Link+1 · D-Link Dns-320+2

Published 2017-08-25 · Updated 2023-04-26 · CVE-2014-7860

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: D-Link DNS-320L versions prior to 1.04b12 D-Link DNS-327L versions prior to 1.03b04 Build0119

Description: The issue allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album id and access token. This is due to the lack of authentication for requests in the web/web file/fb publish.php script.

Recommendations: For D-Link DNS-320L versions prior to 1.04b12, update to version 1.04b12 or later. For D-Link DNS-327L versions prior to 1.03b04 Build0119, update to version 1.03b04 Build0119 or later.

Fix

Information Disclosure

Improper Authentication

Weakness Enumeration

CWE-200

CWE-287

Related Identifiers

CVE-2014-7860

Affected Products

D-Link Dns-320

D-Link Dns-327L

Facebook

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-7860 · Security Note
• http://seclists.org/fulldisclosure/2015/May/125 · Note
• http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.html · Note
• http://securityfocus.com/bid/74884 · Note
• http://search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf · Note
• http://securityfocus.com/archive/1/535626/100/200/threaded · Note