PT-2018-3906 · D Link · D-Link Dsl-3782

Giulio Comi · Published 2018-05-23 · Updated 2023-05-20 · CVE-2018-8898

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version V100R001B012

Description A flaw in the authentication mechanism of the Login Panel allows unauthenticated attackers to perform arbitrary modification to passwords and configurations while an administrator is logged into the web panel. This issue is related to deficiencies in the authentication procedure, which can be exploited by a remote attacker to bypass authentication and gain access to confidential information using a specially crafted request.

Recommendations For D-Link DSL-3782 version V100R001B012, as a temporary workaround, consider restricting access to the Login Panel until a patch is available. Additionally, limit the use of the web panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-03057

CVE-2018-8898

Affected Products

D-Link Dsl-3782

References · 5

• 🔥 http://packetstormsecurity.com/files/147708/D-Link-DSL-3782-Authentication-Bypass.html · Exploit
• 🔥 https://exploit-db.com/exploits/44657 · Exploit
• https://osv.dev/vulnerability/CVE-2018-8898 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8898 · Security Note