PT-2020-10101 · D Link · Dsl-2680

Published 2020-03-04 · Updated 2023-04-26 · CVE-2019-19222

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions D-Link DSL-2680 version EU 1.03

Description A Stored XSS issue in the web administration interface allows an authenticated attacker to inject arbitrary JavaScript code into the administration page by sending a crafted "Forms/wireless autonetwork 1" POST request to the "info.html" page.

Recommendations For version EU 1.03, consider disabling access to the info.html administration page until a patch is available. Restrict access to the Forms/wireless autonetwork 1 POST request to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19222

Affected Products

Dsl-2680

References · 7

• 🔥❌ https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19222.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2019-19222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19222 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• ❌ https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities · Note, Deleted
• https://ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf · Note
• https://t.me/cvenotify/1318 · Telegram Post