PT-2019-13421 · D Link · D-Link Dir-655

Published 2019-07-11 · Updated 2021-04-23 · CVE-2019-13560

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 C versions prior to 3.02B05 BETA03

Description The issue allows remote attackers to force a blank password. This is achieved through the apply sec.cgi API endpoint, specifically by manipulating the setup wizard parameter.

Recommendations For versions prior to 3.02B05 BETA03, update to version 3.02B05 BETA03 or later to resolve the issue. As a temporary workaround, consider restricting access to the apply sec.cgi API endpoint to minimize the risk of exploitation. Avoid using the setup wizard parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2019-13560

Affected Products

D-Link Dir-655

References · 5

• 🔥 https://nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce · Exploit
• https://osv.dev/vulnerability/CVE-2019-13560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13560 · Security Note
• ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_RELEASE_NOTES_v3.02B05_BETA03.pdf · Note
• https://nccgroup.trust/contentassets/7188fe7f130846ffa31827fc1661d120/setupwizard.txt · Note