PT-2020-9980 · D Link · D-Link Dap-1360

Daniel Schlör · Published 2020-05-15 · Updated 2023-04-26 · CVE-2019-18666

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1360 revision F versions 609EU through 613EUbeta D-Link DAP-1360 revision F versions through 6.12b01

Description: An issue was discovered on D-Link DAP-1360 revision F devices, allowing remote attackers to start a telnet service without authorization via an undocumented HTTP request. The impact depends on the firmware version. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed, but the telnet service can still be started without authorization.

Recommendations: For versions 609EU through 613EUbeta, update the firmware to a version later than 6.12b01 to change the weak root credentials. For versions through 6.12b01, update the firmware to a version later than 6.12b01 to change the weak root credentials. As a temporary workaround, consider disabling the telnet service until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-18666

Affected Products

D-Link Dap-1360

References · 7

• 🔥 https://daschloer.github.io/sec/dlink-dap-1360.html · Exploit
• 🔥 http://c1a.eu/dlink-dap-1360.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-18666 · Vendor Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18666 · Security Note
• https://t.me/cibsecurity/12118 · Telegram Post
• https://t.me/cvenotify/3843 · Telegram Post