PT-2018-17102 · D Link · D-Link Dir-601

Kevin Randall · Published 2018-03-30 · Updated 2019-10-03 · CVE-2018-5708

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: D-Link DIR-601 B1 version 2.02NA

Description: An issue allows an unauthenticated user on the same local network to obtain the admin username and cleartext password from the administrator's panel. This is achieved through the configuration file restore default, which displays sensitive information in XML.

Recommendations: For D-Link DIR-601 B1 version 2.02NA, as a temporary workaround, consider restricting access to the administrator's panel and the configuration file restore default to minimize the risk of exploitation. Avoid using the device on untrusted networks until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-5708

Affected Products

D-Link Dir-601

References · 5

• 🔥 https://exploit-db.com/exploits/44388 · Exploit
• https://osv.dev/vulnerability/CVE-2018-5708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5708 · Security Note
• http://seclists.org/fulldisclosure/2018/Mar/66 · Note
• https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10111 · Note