← Zuruck zu CVEs

CVE-2019-18666

CRITICAL

9.8

Beschreibung

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed but the telnet service can still be started without authorization.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht5/15/2020

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

dlink:dap-1360_revision_fdlink:dap-1360_revision_f_firmware

Schwachen (CWE)

CWE-306

Referenzen

http://c1a.eu/dlink-dap-1360.html(cve@mitre.org)

https://daschloer.github.io/sec/dlink-dap-1360.html(cve@mitre.org)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171(cve@mitre.org)

http://c1a.eu/dlink-dap-1360.html(af854a3a-2127-422b-91ae-364da2661108)

https://daschloer.github.io/sec/dlink-dap-1360.html(af854a3a-2127-422b-91ae-364da2661108)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.