PT-2018-3885 · D Link · D-Link Dir-809 Guest Zone+2

Published 2018-10-09 · Updated 2023-04-26 · CVE-2018-14080

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-809 A1 versions 1.09 and earlier D-Link DIR-809 A2 versions 1.11 and earlier D-Link DIR-809 Guest Zone versions 1.09 and earlier

Description An issue allows bypassing authentication mechanisms to download the configuration file. The vulnerability is related to deficiencies in the authentication procedure, which can be exploited by a remote attacker to bypass existing security restrictions and download the configuration file.

Recommendations For D-Link DIR-809 A1 versions 1.09 and earlier, update to a version later than 1.09 to resolve the issue. For D-Link DIR-809 A2 versions 1.11 and earlier, update to a version later than 1.11 to resolve the issue. For D-Link DIR-809 Guest Zone versions 1.09 and earlier, update to a version later than 1.09 to resolve the issue. As a temporary workaround, consider restricting access to the configuration file until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-02774

CVE-2018-14080

Affected Products

D-Link Dir-809 A1

D-Link Dir-809 A2

D-Link Dir-809 Guest Zone

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-14080 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14080 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02774 · Security Note
• https://vuldb.com/ru/?id.125138 · Note
• https://blog.nivel4.com/investigaciones/nuevas-vulnerabilidades-en-router-d-link-permiten-tomar-control-remoto-del-dispositivo · Note