PT-2019-4071 · D Link · D-Link Dap-1320 A2

Published 2019-10-11 · Updated 2020-08-24 · CVE-2019-17505

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DAP-1320 A2 versions prior to V1.21

Description The issue is related to weaknesses in the authentication procedure of the web interface in D-Link DAP-1320 A2 wireless router firmware. This can allow a remote attacker to gain unauthorized access to protected information, including Wi-Fi SSID and password, potentially using a brute-force method to guess the password. An attacker can obtain a user's Wi-Fi SSID and password, which could be used to connect to Wi-Fi or perform a dictionary attack.

Recommendations For D-Link DAP-1320 A2 versions prior to V1.21, consider disabling remote access to the web interface until a patch is available. Restrict access to the uplink info.xml file to minimize the risk of exploitation. Avoid using default or weak passwords for Wi-Fi networks to reduce the risk of brute-force attacks.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

BDU:2019-04632

CVE-2019-17505

Affected Products

D-Link Dap-1320 A2

References · 5

• 🔥 https://github.com/dahua966/Routers-vuls/blob/master/DAP-1320/vuls_poc.md · Exploit
• https://bdu.fstec.ru/vul/2019-04632 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-17505 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17505 · Vendor Advisory
• https://cxsecurity.com/cveshow/CVE-2019-17505 · Note