Lucene search

MitreCVE-2018-17777

HistoryDec 18, 2018 - 10:29 p.m.

CVE-2018-17777

2018-12-1822:29:04

CWE-287

mitre

web.nvd.nist.gov

cve-2018-17777

d-link

dva-5592

a1_wi_20180823

security vulnerability

bypass login

router control panel

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

68.8%

JSON

An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page “/ui/cbpc/login” is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie “sid” generated by the page. The attacker will have access to the router control panel with administrator privileges.

Affected configurations

Nvd

Node

dlinkdva-5592Match-

AND

dlinkdva-5592_firmwareMatcha1_wi_20180823

VendorProductVersionCPE
dlinkdva-5592-cpe:2.3:h:dlink:dva-5592:-:*:*:*:*:*:*:*
dlinkdva-5592_firmwarea1_wi_20180823cpe:2.3:o:dlink:dva-5592_firmware:a1_wi_20180823:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dlink	dva-5592	-	cpe:2.3:h:dlink:dva-5592:-:::::::*
dlink	dva-5592_firmware	a1_wi_20180823	cpe:2.3:o:dlink:dva-5592_firmware:a1_wi_20180823:::::::*

References

www.gubello.me/blog/router-dlink-dva-5592-authentication-bypass/

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

68.8%

JSON

Related for CVE-2018-17777