Lucene search

MitreCVE-2021-41503

HistorySep 24, 2021 - 8:15 p.m.

CVE-2021-41503

2021-09-2420:15:07

CWE-287

mitre

web.nvd.nist.gov

cve-2021-41503

dcs-5000l

dcs-932l

incorrect access control

basic authentication

lan access

security vulnerability

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

Percentile

12.6%

JSON

DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected configurations

Nvd

Node

dlinkdcs-932l_firmwareRange≤2.17

AND

dlinkdcs-932lMatch-

Node

d-linkdcs-5000l_firmwareMatch1.05

AND

dlinkdcs-5000lMatch-

VendorProductVersionCPE
dlinkdcs-932l_firmware*cpe:2.3:o:dlink:dcs-932l_firmware:*:*:*:*:*:*:*:*
dlinkdcs-932l-cpe:2.3:h:dlink:dcs-932l:-:*:*:*:*:*:*:*
d-linkdcs-5000l_firmware1.05cpe:2.3:o:d-link:dcs-5000l_firmware:1.05:*:*:*:*:*:*:*
dlinkdcs-5000l-cpe:2.3:h:dlink:dcs-5000l:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dlink	dcs-932l_firmware	*	cpe:2.3:o:dlink:dcs-932l_firmware::::::::
dlink	dcs-932l	-	cpe:2.3:h:dlink:dcs-932l:-:::::::*
d-link	dcs-5000l_firmware	1.05	cpe:2.3:o:d-link:dcs-5000l_firmware:1.05:::::::*
dlink	dcs-5000l	-	cpe:2.3:h:dlink:dcs-5000l:-:::::::*

References

supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10247

www.dlink.com/en/security-bulletin/

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2021-41503