PT-2018-18795 · D Link · Dir-850L

Gem George · Published 2018-03-27 · Updated 2021-04-23 · CVE-2018-9032

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version: A1, B1; Firmware Version: 1.02 through 2.06)

Description The issue allows attackers to bypass the SharePort Web Access Portal. This can be achieved by directly visiting "category view.php" or "folder view.php" API endpoints.

Recommendations For Firmware Version 1.02 through 2.06, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "category view.php" and "folder view.php" API endpoints until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-9032

Affected Products

Dir-850L

References · 4

• 🔥 https://exploit-db.com/exploits/44378 · Exploit
• https://osv.dev/vulnerability/CVE-2018-9032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9032 · Security Note
• https://youtube.com/watch?v=Wmm4p8znS3s · Note