PT-2017-7914 · D Link · D-Link Dsl-2740E

Published 2017-10-31 · Updated 2023-04-26 · CVE-2016-10699

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions D-Link DSL-2740E version 1.00 BG 20150720

Description The issue allows for persistent XSS attacks through the username and password fields. A remote unauthenticated user can craft logins and passwords with script tags, which can affect an unaware logged-in administrator when checking the router logs, due to the lack of sanitization in the input fields.

Recommendations For D-Link DSL-2740E version 1.00 BG 20150720, as a temporary workaround, consider disabling the login functionality until a patch is available, and restrict access to the router logs to minimize the risk of exploitation. Avoid using the username and password fields in the affected login form until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10699

Affected Products

D-Link Dsl-2740E

References · 4

• 🔥 https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-018/?fid=8411 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10699 · Security Note
• http://securityfocus.com/bid/101622 · Note