PT-2018-18218 · D Link · Mydlink++2

Nick Leghorn · Published 2018-03-05 · Updated 2019-10-03 · CVE-2018-7698

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: D-Link mydlink+ version 3.8.5 build 259 D-Link DCS-933L version 1.05.04 D-Link DCS-934L version 1.05.04

Description: An issue was discovered where the mydlink+ app sends the username and password for connected D-Link cameras unencrypted from the app to the camera. This allows attackers to obtain these credentials and gain control of the camera, including the ability to view the camera's stream and make changes without the user's knowledge.

Recommendations: For D-Link mydlink+ version 3.8.5 build 259, consider disabling the camera connection feature until a patch is available. For D-Link DCS-933L version 1.05.04, restrict access to the camera's stream and configuration settings to minimize the risk of exploitation. For D-Link DCS-934L version 1.05.04, avoid using the mydlink+ app to connect to the camera until the issue is resolved.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-7698

Affected Products

Dcs-933L

Dcs-934L

Mydlink+

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7698 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7698 · Vendor Advisory
• https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords · Note