PT-2018-3889 · D Link · D-Link Dir-601

Kevin Randall · Published 2018-08-17 · Updated 2023-04-26 · CVE-2018-12710

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-601 version 2.02NA

Description An issue allows an attacker with low privilege "User" account access to intercept the response from a POST request and obtain "Admin" rights due to the admin password being displayed in XML. The vulnerability is related to the transmission of critical information in plain text, which can be exploited by a remote attacker to elevate their privileges.

Recommendations For D-Link DIR-601 version 2.02NA, as a temporary workaround, consider restricting access to the affected POST request endpoint until a patch is available. Avoid using the device with low privilege accounts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2023-02934

CVE-2018-12710

Affected Products

D-Link Dir-601

References · 5

• 🔥 https://exploit-db.com/exploits/45306 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12710 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12710 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02934 · Security Note
• http://seclists.org/fulldisclosure/2018/Aug/45 · Note