PT-2018-1748 · D Link · Dwr-512+7

Błażej Adamczyk + 1 · Published 2018-10-12 · Updated 2023-11-08 · CVE-2018-10824

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DWR-116 versions 1.06 and earlier D-Link DIR-140L versions 1.02 and earlier D-Link DIR-640L versions 1.02 and earlier D-Link DWR-512 versions 2.02 and earlier D-Link DWR-712 versions 2.02 and earlier D-Link DWR-912 versions 2.02 and earlier D-Link DWR-921 versions 2.02 and earlier D-Link DWR-111 versions 1.01 and earlier

Description The issue concerns the storage of administrative passwords in plaintext in the /tmp/csman/0 file. An attacker with directory traversal or Local File Inclusion (LFI) capabilities can easily gain full access to the router. This allows a remote attacker to potentially gain full control over the device.

Recommendations For D-Link DWR-116 versions 1.06 and earlier, update the firmware to remove the plaintext password storage. For D-Link DIR-140L versions 1.02 and earlier, update the firmware to remove the plaintext password storage. For D-Link DIR-640L versions 1.02 and earlier, update the firmware to remove the plaintext password storage. For D-Link DWR-512 versions 2.02 and earlier, update the firmware to remove the plaintext password storage. For D-Link DWR-712 versions 2.02 and earlier, update the firmware to remove the plaintext password storage. For D-Link DWR-912 versions 2.02 and earlier, update the firmware to remove the plaintext password storage. For D-Link DWR-921 versions 2.02 and earlier, update the firmware to remove the plaintext password storage. For D-Link DWR-111 versions 1.01 and earlier, update the firmware to remove the plaintext password storage. As a temporary workaround, consider restricting access to the /tmp/csman/0 file to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Path traversal

Weakness Enumeration

CWE-522

CWE-22

CWE-256

Related Identifiers

BDU:2018-01348

CVE-2018-10824

Affected Products

Dir-140L

Dir-640L

Dwr-111

Dwr-116

Dwr-512

Dwr-712

Dwr-912

Dwr-921

References · 9

• 🔥 http://sploit.tech/2018/10/12/D-Link.html · Exploit
• 🔥 https://exploit-db.com/exploits/45677 · Exploit
• 🔥 https://seclists.org/fulldisclosure/2018/Oct/36 · Exploit
• https://bdu.fstec.ru/vul/2018-01348 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10824 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10824 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2018101711?affChecked=1 · Note
• https://seclists.org/fulldisclosure/2018/Oct/43 · Note
• https://xakep.ru/2018/10/18/d-link-bunch-of-bugs · Note