PT-2020-10103 · D Link · D-Link Dsl-2680

Published 2019-12-09 · Updated 2023-04-26 · CVE-2019-19224

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions D-Link DSL-2680 version EU 1.03

Description A Broken Access Control issue in the web administration interface allows an attacker to download configuration settings by submitting a "rom-0" GET request without authentication on the admin interface.

Recommendations For D-Link DSL-2680 version EU 1.03, consider restricting access to the web administration interface until a fix is available. As a temporary workaround, avoid using the "rom-0" GET request in the admin interface to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-306

CWE-755

Related Identifiers

BDU:2020-01435

CVE-2019-19224

Affected Products

D-Link Dsl-2680

References · 18

• 🔥❌ https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19224.md · Exploit, Deleted
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01435 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19224 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19924 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-19924 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19224 · Vendor Advisory
• https://github.com/sqlite/sqlite/commit/57f7ece78410a8aae86aa4625fb7556897db384c · Note
• https://ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf · Note
• https://suse.com/security/cve/CVE-2019-19224 · Note
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19224 · Note