Default credentials

2018-08-2919:29:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

High

0.606 Medium

EPSS

Percentile

97.8%

JSON

An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only “User” account (which is a low privilege account) access, an attacker can intercept the response from a POST request to obtain “Admin” rights due to the admin password being displayed in XML.

CPENameOperatorVersion
dir-601_firmwareeq2.2.0-na

CPE	Name	Operator	Version
	dir-601_firmware	eq	2.2.0-na

References

seclists.org/fulldisclosure/2018/Aug/45

www.exploit-db.com/exploits/45306/