PT-2019-6348 · D Link · Dir-825

Published 2019-02-25 · Updated 2023-11-08 · CVE-2019-9126

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR-825 versions 2.10

Description The issue is related to a lack of protection for service data, which can be exploited by a remote attacker to disclose protected information by requesting the router info.xml document. This can reveal sensitive device information, including the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN information.

Recommendations For version 2.10, consider restricting access to the router info.xml document until a patch is available. As a temporary workaround, limit remote access to the device to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-02834

CVE-2019-9126

Affected Products

Dir-825

References · 5

• 🔥 https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-825/information%20disclosure.md · Exploit
• https://bdu.fstec.ru/vul/2023-02834 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9126 · Security Note
• https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-825/information20disclosure.md · Note