D-Link Routers - Directory Traversal
| Reporter | Title | Published | Views | Family All 44 |
|---|---|---|---|---|
 | D-Link Routers - Plaintext Password Vulnerability | 25 Oct 201800:00 | – | zdt |
| D-Link Routers - Directory Traversal Vulnerability | 25 Oct 201800:00 | – | zdt |
 | D-Link Router File Read | 16 Nov 201800:00 | – | bdu_fstec |
| D-Link router storage of passwords in unencrypted form | 16 Nov 201800:00 | – | bdu_fstec |
 | CVE-2018-10822 | 17 Oct 201815:59 | – | circl |
| CVE-2018-10824 | 17 Oct 201815:59 | – | circl |
 | D-Link DWR-116 Arbitrary File Download Vulnerability | 11 Apr 201700:00 | – | cnvd |
| D-Link Router Password Plaintext Storage Vulnerability | 17 Oct 201800:00 | – | cnvd |
| D-Link router httpd server directory traversal vulnerability | 17 Oct 201800:00 | – | cnvd |
 | CVE-2017-6190 | 10 Apr 201714:00 | – | cve |
10
Directory Traversal
CVE: CVE-2018-10822
CVSS v3: 8.6
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Description: Directory traversal vulnerability in the web interface on D-Link routers:
DWR-116 through 1.06,
DIR-140L through 1.02,
DIR-640L through 1.02,
DWR-512 through 2.02,
DWR-712 through 2.02,
DWR-912 through 2.02,
DWR-921 through 2.02,
DWR-111 through 1.01,
and probably others with the same type of firmware
allows remote attackers to read arbitrary files via a /.. or // after “GET /uir” in an HTTP request.
NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.
PoC:
`$ curl http://routerip/uir//etc/passwd`
The vulnerability can be used retrieve administrative password using the other disclosed vulnerability - CVE-2018-10824.
This vulnerability was reported previously by Patryk Bogdan in CVE-2017-6190 but he reported it is fixed in certain release but unfortunately it is still present in even newer releases. The vulnerability is also present in other D-Link routers and can be exploited not only (as the original author stated) by double dot but also absolutely using double slash.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 Oct 2018 00:00Current
0.5Low risk
Vulners AI Score0.5
EPSS0.39268