Authentication flaw

2019-03-2522:29:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

77.7%

JSON

D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users’ DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10).

CPENameOperatorVersion
dir-816_firmwareeq2.06
dir-816l_firmwareeq2.06
dir-817lw_firmwareeq1.04
dir-850l_firmwareeq1.09
dir-868l_firmwareeq1.10

Name	Operator	Version
dir-816_firmware	eq	2.06
dir-816l_firmware	eq	2.06
dir-817lw_firmware	eq	1.04
dir-850l_firmware	eq	1.09
dir-868l_firmware	eq	1.10

References

github.com/xw77cve/CVE-2019-7642/blob/master/README.md